CVE-2026-103118 in GraphicsMagick
Summary
by MITRE • 09/30/2026
A vulnerability was detected in GraphicsMagick up to 1.3.47. Affected by this vulnerability is the function ExtractPostscript of the file coders/wpg.c of the component WPG File Handler. Performing a manipulation results in uncontrolled recursion. The attack may be initiated remotely. The patch is named 627b5b1b2fc2. It is suggested to install a patch to address this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified within GraphicsMagick versions up to 1.3.47 represents a critical flaw in the WPG File Handler component, specifically residing in the ExtractPostscript function located in the coders/wpg.c source file. This issue is classified as an uncontrolled recursion error, which fundamentally stems from inadequate validation of input data structures during the parsing and processing of WPG files that contain embedded PostScript content. When a maliciously crafted WPG file is processed by GraphicsMagick, the ExtractPostscript function fails to properly track or limit recursive calls triggered by nested or circular references within the PostScript code. This lack of depth checking allows the recursion to proceed indefinitely until system resources are exhausted.
From a technical perspective, this flaw aligns with CWE-674, which describes uncontrolled recursion leading to stack overflow conditions. The vulnerability is particularly dangerous because it can be exploited remotely without requiring any user interaction beyond opening or processing the malicious file within an application that utilizes GraphicsMagick as its image processing backend. The attacker constructs a WPG file containing specific PostScript commands designed to trigger repeated calls back into the extraction logic, effectively creating an infinite loop at the system level. This behavior consumes CPU cycles and memory rapidly, leading to a denial of service condition where the affected process crashes or becomes unresponsive.
The operational impact of this vulnerability is significant for any organization relying on GraphicsMagick for automated image processing workflows, such as document conversion services, web applications handling user-uploaded images, or enterprise content management systems. An attacker can leverage this flaw to cause a denial of service against critical infrastructure by sending specially crafted WPG files through network interfaces that accept file uploads or process external documents. This aligns with the MITRE ATT&CK technique T1496, Resource Hijacking, specifically sub-technique T1496.001, which involves using resources to cause a denial of service. The ability to initiate this attack remotely makes it a high-risk threat vector for internet-facing services that process image files.
Mitigation strategies must prioritize the immediate application of patch 627b5b1b2fc2 provided by the vendor. This update addresses the root cause by implementing proper recursion depth limits and input validation within the ExtractPostscript function to prevent infinite loops. Organizations should also consider implementing network-level controls such as file size restrictions, timeout mechanisms for image processing tasks, and sandboxing of image conversion processes to limit the blast radius if a vulnerability is exploited in other components. Regularly updating GraphicsMagick and monitoring vendor advisories are essential practices to maintain security posture against evolving threats targeting multimedia libraries.