CVE-2026-77118 in GraphicsMagick
Summary
by MITRE • 08/20/2026
A heap out-of-bounds write exists in the Photo CD (PCD) decoder of GraphicsMagick. In DecodeImage() (coders/pcd.c), the Huffman delta loop advances its output pointer with q++ after every decoded delta and never checks it against the end of the heap-allocated luma/chroma plane buffers. The pointer is repositioned only when a sync marker introduces a new plane/row; between sync markers the run length is bounded solely by the input.
A crafted PCD file that positions the pointer near the end of a plane and then supplies a long run of deltas with no intervening sync therefore walks the pointer past the end of the allocation and writes through it. Processing an untrusted PCD file — for example with gm convert or gm identify, or through any application linked against libGraphicsMagick — can corrupt heap memory beyond the buffers.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified in GraphicsMagick represents a critical heap-based buffer overflow within the Photo CD (PCD) image decoder subsystem. This flaw is specifically located in the DecodeImage function found in the coders/pcd.c source file, where the processing of Huffman-encoded delta data fails to perform essential bounds checking on memory write operations. The PCD format utilizes a specific decoding mechanism involving sync markers that delineate planes and rows within an image structure. During normal operation, the decoder processes compressed delta values representing luminance or chrominance information. However, the implementation logic for advancing the output pointer during this Huffman delta loop is fundamentally flawed because it increments the pointer using a simple post-increment operator after each decoded value without verifying that the new address remains within the allocated boundaries of the heap-allocated luma or chroma plane buffers.
The technical root cause lies in the assumption that input data will always conform to expected structural constraints, specifically regarding the frequency and placement of sync markers. The pointer is only repositioned when a sync marker introduces a new plane or row, which serves as an implicit boundary check under normal circumstances. However, between these sync markers, the run length of deltas is bounded solely by the input data itself rather than by the size of the destination buffer. This design oversight means that if a crafted PCD file contains a sequence of delta values with no intervening sync marker for an extended duration, the decoder will continue to write output data beyond the end of the allocated heap memory. The pointer effectively walks past the allocation boundary, resulting in a heap out-of-bounds write condition where arbitrary memory locations adjacent to the buffer are overwritten with decoded image data.
From a security impact perspective, this vulnerability allows for remote code execution or denial of service when processing untrusted PCD files. An attacker can construct a malicious PCD file that positions the internal pointer near the end of a plane and then supplies a long run of deltas without any sync markers to force the write operation into adjacent heap memory. This corruption can lead to various severe consequences depending on the state of the heap at the time of exploitation, including arbitrary code execution through control flow hijacking or application crashes leading to denial of service. The risk is amplified because GraphicsMagick is widely used as a backend library for many other applications and command-line tools such as gm convert and gm identify. Consequently, any software linked against libGraphicsMagick inherits this vulnerability, potentially exposing users who open maliciously crafted image files in various graphical or command-line contexts to exploitation without their knowledge.
This flaw aligns with CWE-787: Out-of-bounds Write, which describes writing data outside the bounds of a buffer, and can be mapped to MITRE ATT&CK techniques related to memory corruption exploits such as T1203: Exploitation for Defense Evasion or more broadly within the context of binary exploitation patterns. To mitigate this risk, immediate patching is required by updating GraphicsMagick to versions that include bounds checking logic in the Huffman delta loop. Developers must ensure that every increment of the output pointer during decoding validates against the maximum allowable address derived from the buffer size and current offset. Additionally, defensive programming practices should be adopted across all image decoders within the library to enforce strict boundary checks regardless of input structure assumptions. Users relying on GraphicsMagick for processing untrusted images should apply these updates promptly and consider implementing sandboxing or file validation layers in front of any application that processes PCD files to reduce the attack surface until patches are fully deployed.