ImageMagick on Windows versions through 7.1.2-33 and 6.9.13-58 contains an uncontrolled search‑path flaw in the NTGhostscriptEXE() function. The function launches the Ghostscript executable gswin64c.exe by bare filename when Ghostscript is not registered. An attacker can place a malicious gswin64c.exe in the working directory and cause ImageMagick to execute it while converting PDF, PostScript, or EPS files. This flaw permits code execution with the privileges of the ImageMagick process, potentially enabling an attacker to run arbitrary instructions, modify data, or elevate privileges.

The vulnerability affects ImageMagick software distributed by ImageMagick:ImageMagick on Windows platforms, specifically versions 7.1.2‑33 and earlier, and 6.9.13‑58 and earlier. Any deployment that processes PDF, PostScript, or EPS input using these versions is susceptible.

The CVSS score of 7.3 denotes a high severity risk. The EPSS score is not available, so exploitation probability is uncertain. The vulnerability is not listed in CISA KEV, meaning no known large‑scale exploits have been reported yet, but the flaw remains exploitable if an attacker can control or write to the working directory or otherwise place a malicious file with the same name. The likely attack vector is local file placement with the ImageMagick process running under elevated privileges. If a service or web application uses ImageMagick to process user‑supplied files, an attacker could potentially trigger execution by supplying a crafted file set that causes the library to invoke the hijacked executable.