ImageMagick gswin64c.exe Ghostscript Delegate Hijack via Non-Standard Path

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•2

Detects the execution of Ghostscript (gswin64c.exe) by ImageMagick (magick.exe or convert.exe), where the binary location does not appear to be a standard installation path. This behavior is a common indicator of exploitation attempts against ImageMagick vulnerabilities, such as ImageTragick or subsequent Ghostscript-based file processing exploits.