ImageMagick EUVD-2026-96696

Exploitation requires a specific set of Windows-only preconditions: (1) Ghostscript must be UNREGISTERED so ImageMagick falls back to launching gswin64c.exe by bare name rather than a fully-qualified registry path; (2) the attacker must be able to write a malicious gswin64c.exe into ImageMagick's current working directory (the uncontrolled search path, CWE-427); and (3) a PDF, PostScript, or EPS file must be converted by ImageMagick, i.e. the Ghostscript delegate must actually be invoked. Limiting factors that reduce real-world risk: the vector is local (the attacker already needs filesystem write access to the working directory), attack complexity is high and a non-default configuration (unregistered Ghostscript) is needed, and a victim-triggered conversion (passive user interaction) is required. Non-Windows installations and installations where Ghostscript is properly registered are not affected.

This is a genuine but conditional, non-urgent issue rather than a mass-exploitation priority. The vendor-supplied CVSS 4.0 vector (AV:L/AC:H/AT:P/PR:N/UI:P) already signals constrained exploitability: a LOCAL attack vector, HIGH attack complexity, a present attack requirement (AT:P, reflecting the non-default precondition that Ghostscript is unregistered), and passive user interaction (a victim must trigger a PDF/PS/EPS conversion). Against those limiters, the impact metrics are maximal (VC:H/VI:H/VA:H) because a hijacked gswin64c.exe runs arbitrary code with ImageMagick's privileges - hence the 7.3 HIGH score is driven by impact, not ease. POC code is publicly available (GitHub) and the finding is credibly sourced to VulnCheck, which raises the practical likelihood that someone could operationalize it, but there is NO CISA KEV listing and no EPSS score was provided in the input, so there is no evidence of active or widespread exploitation. Net: treat as a defense-in-depth / local-privilege-adjacent concern on Windows hosts that process untrusted documents, not an internet-facing emergency.

On a Windows host where Ghostscript is installed but not registered (or absent while a stale binary name resolves via the search path), an attacker who can write a file named gswin64c.exe into ImageMagick's working directory waits for a user or automated job to convert a PDF, PostScript, or EPS file. ImageMagick's NTGhostscriptEXE() invokes the Ghostscript delegate by bare name, so the planted binary executes with ImageMagick's privileges. A public proof-of-concept for this delegate hijack exists on GitHub.