ImageMagick on Windows through 7.1.2-33 and 6.9.13-58 contains an uncontrolled search path vulnerability in NTGhostscriptEXE() that launches… (CVE-2026-108693)

The vulnerability (CVE-2026-108693) affects ImageMagick on Windows up to versions 7.1.2-33 and 6.9.13-58. The NTGhostscriptEXE() function calls the Ghostscript executable gswin64c.exe without specifying a full path when Ghostscript is not registered. This allows an attacker to plant a malicious executable named gswin64c.exe in the working directory, which will be executed with the privileges of the ImageMagick process when converting certain file types (PDF, PostScript, EPS). This is an uncontrolled search path vulnerability classified under CWE-427.

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the ImageMagick process on Windows systems. This can lead to full compromise of the affected system depending on the privileges held by ImageMagick. The vulnerability affects local attack vectors where an attacker can influence the working directory or file placement.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict untrusted users from controlling the working directory or placing executables in directories where ImageMagick runs. Consider running ImageMagick with least privilege and in controlled environments to reduce risk.