8.4

CVE-2026-77118

Out-of-bounds write in GraphicsMagick PCD decoder

A heap out-of-bounds write exists in the Photo CD (PCD) decoder of GraphicsMagick. In DecodeImage() (coders/pcd.c), the Huffman delta loop advances its output pointer with q++ after every decoded delta and never checks it against the end of the heap-allocated luma/chroma plane buffers. The pointer is repositioned only when a sync marker introduces a new plane/row; between sync markers the run length is bounded solely by the input.



A crafted PCD file that positions the pointer near the end of a plane and then supplies a long run of deltas with no intervening sync therefore walks the pointer past the end of the allocation and writes through it. Processing an untrusted PCD file — for example with gm convert or gm identify, or through any application linked against libGraphicsMagick — can corrupt heap memory beyond the buffers.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerGraphicsMagick Group
≫
Produkt GraphicsMagick
Default Statusunaffected
Version 1.0.0
Version < 1.3.48
Status affected
HerstellerDebian
≫
Produkt graphicsmagick
Default Statusunaffected
Version 0
Version < 1.4+really1.3.48-1
Status affected
HerstellerFedora Project
≫
Produkt GraphicsMagick
Default Statusunaffected
Version 0
Version < 1.3.48
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
22e2d327-25fe-45d7-9f0c-dcd23b7108df 8.4 0 0
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/937cdd9920bd96
https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/raw/GraphicsMagick-1_3_48/ChangeLog