ImageMagick on Windows hit by high-severity Ghostscript path flaw

ImageMagick on Windows has an uncontrolled search path vulnerability, tracked as CVE-2026-108693, that can let an attacker run code by planting a fake Ghostscript executable. The CVE record covers ImageMagick 7 through 7.1.2-33 and ImageMagick 6 through 6.9.13-58.

How it works. When Ghostscript is not registered on the system, ImageMagick's NTGhostscriptEXE() function launches gswin64c.exe by bare name instead of a full path. An attacker who places a malicious gswin64c.exe in the working directory gets it executed, with ImageMagick's privileges, when a PDF, PostScript or EPS file is converted there. The input file itself does not need to be malicious.

Severity. VulnCheck, the CVE Numbering Authority that assigned the CVE, rates it 7.0 (high) under CVSS 3.1 and 7.3 (high) under CVSS 4.0. Its vector marks the attack as local, of high complexity and requiring user interaction. NVD has received the record but has not yet published its own score.

Fix status. The affected range includes 7.1.2-33, the newest ImageMagick release as of October 10, and neither the CVE record nor GitHub's advisory (GHSA-92c8-5jfq-j2vj) names a fixed version.

References. The record links the relevant lines of nt-base.c in the ImageMagick source, a public proof-of-concept repository and VulnCheck's advisory. Researchers Muhammad Ali and Hasan Anwar are credited with finding it.