Uncontrolled Recursion Vulnerability in GraphicsMagick WPG File Handler
CVE-2026-103118

5.3MEDIUM

Key Information:

Vendor

GraphicsMagick

Status
Graphicsmagick
Vendor
CVE Published:
30 September 2026

What is CVE-2026-103118?

A vulnerability in the WPG File Handler of GraphicsMagick versions up to 1.3.47 allows for uncontrolled recursion through the ExtractPostscript function in coders/wpg.c. This flaw can be exploited remotely, potentially leading to system instability and performance issues. To mitigate this risk, users are advised to apply the patch identified by changeset 627b5b1b2fc2, which the vendor has developed in response to the issue. Prompt action is recommended to secure systems against potential attacks.

Affected Version(s)

GraphicsMagick 1.3.0

GraphicsMagick 1.3.1

GraphicsMagick 1.3.2

References

https://vuldb.com/vuln/411874
vdb-entrytechnical-description
https://vuldb.com/vuln/411874/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-103118
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

zzxzzb (VulDB User)
VulDB CNA Team
.