Heap Out-of-Bounds Write in GraphicsMagick Photo CD Decoder
CVE-2026-77118

8.4HIGH

Key Information:

Vendor

Graphicsmagick Group

Status
Graphicsmagick
Graphicsmagick
Vendor
CVE Published:
20 August 2026

What is CVE-2026-77118?

A vulnerability exists in the Photo CD (PCD) decoder of GraphicsMagick where a heap out-of-bounds write can occur in the DecodeImage() function. This results from the Huffman delta loop advancing the output pointer without adequately checking its position, allowing it to write beyond the allocated memory for luma/chroma plane buffers. If a specially crafted PCD file is processed, it can initiate a write operation beyond the intended memory limits, corrupting the heap memory and potentially leading to application crashes or other unpredictable behaviors. Users are advised to upgrade to GraphicsMagick version 1.3.48 or later to mitigate this issue.

Affected Version(s)

graphicsmagick 0 < 1.4+really1.3.48-1

GraphicsMagick 0 < 1.3.48

GraphicsMagick Linux 1.0.0 < 1.3.48

References

https://foss.heptapod.net/graphicsmagick/graphicsmagick/-...
patch
https://foss.heptapod.net/graphicsmagick/graphicsmagick/-...
release-notes

CVSS V4

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Cipher - Causal Security (https://causalsecurity.com/), who discovered the defect and reported it to the GraphicsMagick maintainer on 2026-06-14
Bob Friesenhahn, GraphicsMagick, for the upstream fix
.