CVE-2026-108693CWE-427

CVE-2026-108693

High · published October 11, 2026

CVSS v3.1
7.0
EPSS
0%
Percentile
2.2
In the wild
Unconfirmed
What it is

ImageMagick on Windows through 7.1.2-33 and 6.9.13-58 contains an uncontrolled search path vulnerability in NTGhostscriptEXE() that launches gswin64c.exe by bare name when Ghostscript is unregistered. Attackers can plant a malicious gswin64c.exe in the working directory to execute code with ImageMagick privileges when PDF, PostScript, or EPS files are converted.

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
7.3 · CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00127 · 2.2th percentile
Weakness
CWE-427 · Uncontrolled Search Path Element
Published
2026-10-11T06:16Z
References (5)
https://github.com/ImageMagick/ImageMagick · [email protected]https://github.com/ImageMagick/ImageMagick/blob/211e5b975a0019a88dcef5f84c1193f46738d815/MagickCore/nt-base.c#L1469-L1511 · [email protected]https://github.com/ImageMagick/ImageMagick/blob/211e5b975a0019a88dcef5f84c1193f46738d815/MagickCore/nt-base.c#L2829-L2832 · [email protected]https://github.com/ghostx-86/exploitarium/tree/main/imagemagick-gs-delegate-hijack-poc · [email protected]https://www.vulncheck.com/advisories/imagemagick-through-7.1.2-33-and-6.9.13-58-uncontrolled-search-path-via-ghostscript-delegate · [email protected]
EPSS history
Timeline
  • 12 OCT 03:26Z
    EPSS moved — → 0%
    epss
  • 11 OCT 01:35Z
    ImageMagick through 7.1.2-33 and 6.9.13-58 Uncontrolled Search Path via Ghostscript Delegate
    cvelistv5
  • 11 OCT 01:35Z
    ImageMagick through 7.1.2-33 and 6.9.13-58 Uncontrolled Search Path via Ghostscript Delegate
    cvelistv5