ImageMagick Ghostscript Delegate Hijack - gswin64c.exe from Writable Path

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects instances where ImageMagick (magick.exe) or legacy conversion tools (convert.exe) spawn Ghostscript executables (gswin64c.exe, gswin32c.exe) from non-standard or user-writable directories (e.g., Temp, AppData, Public). This pattern is indicative of a delegate path hijacking attack, where an adversary attempts to execute arbitrary code by forcing a vulnerable application to load a malicious Ghostscript binary instead of the legitimate, installed version.