CVE-2026-77118: Out-of-bounds write in GraphicsMagick PCD decoder

Severity: high (CVSS 8.4 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-20 · updated 2026-10-27
Weakness: CWE-787

Description

A heap out-of-bounds write exists in the Photo CD (PCD) decoder of GraphicsMagick. In DecodeImage() (coders/pcd.c), the Huffman delta loop advances its output pointer with q++ after every decoded delta and never checks it against the end of the heap-allocated luma/chroma plane buffers. The pointer is repositioned only when a sync marker introduces a new plane/row; between sync markers the run length is bounded solely by the input. A crafted PCD file that positions the pointer near the end of a plane and then supplies a long run of deltas with no intervening sync therefore walks the pointer past the end of the allocation and writes through it. Processing an untrusted PCD file — for example with gm convert or gm identify, or through any application linked against libGraphicsMagick — can corrupt heap memory beyond the buffers.

Affected products

Debian graphicsmagick: before 1.4+really1.3.48-1 — fixed in 1.4+really1.3.48-1
Fedora Project GraphicsMagick: before 1.3.48 — fixed in 1.3.48
GraphicsMagick Group GraphicsMagick: from 1.0.0 before 1.3.48 — fixed in 1.3.48

How to fix

Upgrade to a fixed version: Debian graphicsmagick 1.4+really1.3.48-1; Fedora Project GraphicsMagick 1.3.48; GraphicsMagick Group GraphicsMagick 1.3.48. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-77118 or the next vulnerability affects your stack