CVE-2026-108693 in ImageMagick
Summary
by MITRE • 10/11/2026
ImageMagick on Windows through 7.1.2-33 and 6.9.13-58 contains an uncontrolled search path vulnerability in NTGhostscriptEXE() that launches gswin64c.exe by bare name when Ghostscript is unregistered. Attackers can plant a malicious gswin64c.exe in the working directory to execute code with ImageMagick privileges when PDF, PostScript, or EPS files are converted.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified as CVE-2023-5817 represents a critical uncontrolled search path weakness within the ImageMagick software suite on Windows operating systems, specifically affecting versions through 7.1.2-33 and 6.9.13-58. This flaw resides in the NTGhostscriptEXE function, which is responsible for invoking Ghostscript to handle image formats such as PDF, PostScript, and EPS that rely on this external interpreter engine. The core technical deficiency lies in how ImageMagick constructs the command line arguments when launching gswin64c.exe. Instead of specifying an absolute path to the executable or verifying its location against a known secure directory, the application relies solely on the bare filename gswin64c.exe. This approach forces the operating system's dynamic linker and loader to search for the binary using the standard PATH environment variables and the current working directory as primary locations. When Ghostscript is not properly registered in the Windows registry or when its installation path is absent from the system PATH, the application defaults to searching the local context where it was invoked.
This architectural oversight creates a classic insecure temporary file or command injection scenario that can be exploited through simple file planting techniques. An attacker who has the ability to write files into the directory where ImageMagick processes images can place a malicious executable named gswin64c.exe in that location. Because Windows prioritizes the current working directory during path resolution for relative commands, the system will load and execute this malicious binary instead of the legitimate Ghostscript interpreter. This behavior is particularly dangerous because it does not require any complex exploitation chain or privilege escalation beyond what ImageMagick itself possesses. If an attacker can trick a user into processing a crafted PDF, PostScript, or EPS file within a controlled directory, they achieve arbitrary code execution with the same privileges as the user running ImageMagick. This is especially severe in server environments where ImageMagic runs under service accounts that may have elevated permissions to read sensitive files or write to specific directories.
The operational impact of this vulnerability extends beyond simple remote code execution on a single workstation. In web applications or automated pipelines that utilize ImageMagick for image conversion, an attacker could potentially compromise the underlying server infrastructure by uploading malicious documents and triggering their processing. This can lead to data exfiltration, installation of backdoors, ransomware deployment, or lateral movement within a network if the compromised account has broader access rights. The vulnerability aligns with CWE-427, which describes Uncontrolled Search Path Element, as it involves relying on an untrusted search path that allows for directory traversal and binary planting. Furthermore, from a tactical perspective in cyber defense frameworks like MITRE ATT&CK, this behavior maps to T1059 Command and Scripting Interpreter via the execution of system binaries, specifically leveraging legitimate tools for malicious purposes through supply chain or local file manipulation tactics.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The most effective solution is to upgrade ImageMagick to a version that has patched this vulnerability by implementing absolute path resolution or strict validation of the Ghostscript executable location before execution. Administrators should ensure that Ghostscript is correctly registered in the Windows registry so that ImageMagick can locate it via standard system mechanisms rather than falling back to insecure search behaviors. Additionally, organizations running ImageMagick on Windows should enforce strict file permissions and directory isolation policies to prevent unauthorized users from writing executables into directories where image processing occurs. Input validation at the application layer is also crucial; while this specific flaw is in the OS-level path resolution, ensuring that only trusted files are processed reduces the attack surface. Security teams should monitor for unusual process creation events involving gswin64c.exe originating from unexpected working directories as an indicator of potential exploitation attempts.