GraphicsMagick Group Photo CD Decoder coders/pcd.c DecodeImage out-of-bounds write

Summaryinfo

A vulnerability identified as critical has been detected in GraphicsMagick Group GraphicsMagick. This affects the function DecodeImage of the file coders/pcd.c of the component Photo CD Decoder. The manipulation leads to out-of-bounds write. This vulnerability is documented as CVE-2026-77118. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in GraphicsMagick Group GraphicsMagick (affected version not known). It has been rated as critical. This issue affects the function DecodeImage of the file coders/pcd.c of the component Photo CD Decoder. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. Using CWE to declare the problem leads to CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A heap out-of-bounds write exists in the Photo CD (PCD) decoder of GraphicsMagick. In DecodeImage() (coders/pcd.c), the Huffman delta loop advances its output pointer with q++ after every decoded delta and never checks it against the end of the heap-allocated luma/chroma plane buffers. The pointer is repositioned only when a sync marker introduces a new plane/row; between sync markers the run length is bounded solely by the input. A crafted PCD file that positions the pointer near the end of a plane and then supplies a long run of deltas with no intervening sync therefore walks the pointer past the end of the allocation and writes through it. Processing an untrusted PCD file — for example with gm convert or gm identify, or through any application linked against libGraphicsMagick — can corrupt heap memory beyond the buffers.

It is possible to read the advisory at foss.heptapod.net. The identification of this vulnerability is CVE-2026-77118 since 08/20/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit.

Applying the patch 937cdd9920bd96 is able to eliminate this problem.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Image Processing Software

Vendor

• GraphicsMagick Group

Name

• GraphicsMagick

License

• open-source

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion