CVE-2026-108693 Overview
CVE-2026-108693 is an uncontrolled search path vulnerability [CWE-427] affecting ImageMagick on Windows through versions 7.1.2-33 and 6.9.13-58. The flaw resides in the NTGhostscriptEXE() function, which invokes gswin64c.exe by bare name when Ghostscript is not registered on the host. An attacker who places a malicious gswin64c.exe in the working directory can execute arbitrary code with ImageMagick privileges when a user converts PDF, PostScript, or EPS files.
Critical Impact
Local attackers can achieve arbitrary code execution with ImageMagick privileges by planting a trojanized gswin64c.exe binary that executes during routine PDF, PostScript, or EPS conversion workflows.
Affected Products
- ImageMagick on Windows versions through 7.1.2-33
- ImageMagick on Windows versions through 6.9.13-58
- Windows systems where Ghostscript is unregistered
Discovery Timeline
- 2026-10-11 - CVE-2026-108693 published to NVD
- 2026-10-15 - Last updated in NVD database
Technical Details for CVE-2026-108693
Vulnerability Analysis
The vulnerability lives in the NTGhostscriptEXE() function in MagickCore/nt-base.c. When ImageMagick processes PDF, PostScript, or EPS files on Windows, it delegates rasterization to Ghostscript. The function first attempts to resolve the Ghostscript path through the Windows registry. If no registration exists, the code falls back to launching gswin64c.exe by its bare filename.
Windows resolves bare executable names using a defined search order that includes the current working directory. An attacker who controls the working directory can therefore stage a malicious gswin64c.exe that executes instead of a legitimate Ghostscript install.
Exploitation requires local access and user interaction, specifically the triggering of a conversion operation on a supported document format. The attacker-supplied binary runs with the same privileges as the ImageMagick process invoking the delegate.
Root Cause
The root cause is an uncontrolled search path element [CWE-427]. The affected code paths in MagickCore/nt-base.c (lines 1469-1511 and 2829-2832) call Windows process creation APIs with an unqualified executable name rather than a fully qualified path. This behavior defers resolution to the operating system search order, which includes attacker-reachable locations.
Attack Vector
An attacker drops a crafted gswin64c.exe into a directory used as the working directory for ImageMagick operations. The victim then runs an ImageMagick command (such as magick convert) against a PDF, PostScript, or EPS file from that directory. ImageMagick invokes the Ghostscript delegate, Windows resolves the bare name to the attacker-controlled binary, and the payload executes with the privileges of the calling process. A public proof of concept is available in the Exploitarium repository.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-108693
Indicators of Compromise
- Presence of gswin64c.exe in non-standard directories such as user Downloads, temp folders, or shared file drops
- gswin64c.exe binaries that are unsigned or signed by publishers other than Artifex Software
- Child processes of magick.exe, convert.exe, or identify.exe originating from unexpected image file paths
Detection Strategies
- Hunt for ImageMagick binaries spawning gswin64c.exe from writable directories outside of Program Files
- Alert on process creation events where the parent is an ImageMagick binary and the child image path resolves to a user-writable location
- Validate the digital signature and expected install path of any gswin64c.exe observed on managed Windows endpoints
Monitoring Recommendations
- Enable Windows Sysmon Event ID 1 logging with image path and parent process fields for all ImageMagick executables
- Monitor file write events that create executables named gswin64c.exe outside the registered Ghostscript installation directory
- Review automated document conversion pipelines for working-directory handling that may expose the delegate call to untrusted input
How to Mitigate CVE-2026-108693
Immediate Actions Required
- Inventory Windows systems running ImageMagick and identify versions at or below 7.1.2-33 and 6.9.13-58
- Install a legitimate Ghostscript release and ensure it is properly registered in the Windows registry so ImageMagick resolves the delegate by full path
- Restrict write access on directories used as working directories for ImageMagick conversion workflows
- Audit automated pipelines that process untrusted PDF, PostScript, or EPS files for exposure to attacker-controlled staging locations
Patch Information
At the time of publication, review the VulnCheck ImageMagick Advisory and the ImageMagick GitHub Repository for the latest fixed releases. Upgrade to a version where NTGhostscriptEXE() resolves Ghostscript using a fully qualified path.
Workarounds
- Install Ghostscript from the official distribution and confirm the registry keys consumed by NTGhostscriptEXE() are populated
- Disable the PS, EPS, and PDF delegates in delegates.xml where document conversion is not required
- Run ImageMagick in a working directory under system control that denies write access to standard and non-privileged users
- Apply application allowlisting to block execution of gswin64c.exe from outside the approved Ghostscript install path
# Configuration example: disable Ghostscript-backed delegates in ImageMagick
# Edit delegates.xml and comment out or remove the ps/eps/pdf entries
# <delegate decode="ps" ... command=""gswin64c" ..."/>
# <delegate decode="eps" ... command=""gswin64c" ..."/>
# <delegate decode="pdf" ... command=""gswin64c" ..."/>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
