High-Risk CVE-2026-108693 Vulnerability in ImageMagick Disclosed

• •CVE-2026-108693 affects ImageMagick versions 7.1.2-33 and 6.9.13-58 on Windows.
• •Attackers can exploit an uncontrolled path vulnerability to execute malicious code.
• •A public proof-of-concept is available, but active exploitation has not been confirmed.

A high-risk vulnerability, CVE-2026-108693, has been identified in ImageMagick versions 7.1.2-33 and 6.9.13-58. This flaw allows attackers to exploit an uncontrolled path vulnerability in the Ghostscript delegate, enabling code execution through a malicious executable named gswin64c.exe. The vulnerability primarily affects Windows systems that utilize ImageMagick for processing PDF, PostScript, or EPS files. Attackers can plant a malicious executable in a writable directory, leading to potential unauthorized access to sensitive data. A proof-of-concept (PoC) has been made publicly available, but there is no confirmation of active exploitation in the wild at this time. Users are advised to review their conversion workflows and apply vendor patches as they become available.