CVE-2026-13606: 
GraphicsMagick vulnerability analysis and mitigation

CVE-2026-13606 is an out-of-bounds write vulnerability in GraphicsMagick's Photo CD (PCD) decoder that can be triggered by a specially crafted PCD file, potentially leading to memory corruption, denial of service, or other unpredictable system behavior. The CVE was published on June 28, 2026, and is currently in "Reserved" status. It affects GraphicsMagick and is classified as HIGH severity (Red Hat Advisory, Red Hat Bugzilla).

The root cause (CWE-787: Out-of-bounds Write) lies in GraphicsMagick's PCD decoder, which allocates per-channel Huffman decode buffers at an exact fit (columns*rows + 1 byte) but advances the write pointer in the decode loop with an unbounded q++ and no per-write bounds check. A crafted PCD file can drive the write pointer past the end of the allocation, producing an attacker-controlled out-of-bounds write (and a preceding out-of-bounds read at the same location). The vulnerability is reachable when decoding a PCD page/subimage index >= 4 (e.g., PCD:file[4]) or with a -size >= 1536x1024 read hint; a bare default decode does not reach the vulnerable code path. PCD files are content-detected by their magic bytes, so the file extension is not a barrier to exploitation. This vulnerability represents the un-ported write-side half of ImageMagick's hardening for CVE-2026-26284 — GraphicsMagick had ported the out-of-bounds read fix but not the per-write bound check and buffer over-allocation (Red Hat Bugzilla).

Successful exploitation can corrupt heap allocator metadata of adjacent allocations, demonstrated in a lab environment to lead to free() of an attacker-influenced pointer in an ASLR-independent manner. While remote code execution was not demonstrated or claimed, the write is both value- and offset-controlled, making the impact potentially severe. At minimum, exploitation can cause denial of service through memory corruption or unpredictable system behavior in any application processing PCD image files via GraphicsMagick (Red Hat Bugzilla, Red Hat Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the available data. The CVE is currently in "Reserved" status, and no EPSS score or CISA KEV catalog listing has been identified. Exploitation requires delivering a specially crafted PCD file to a target system running GraphicsMagick, and the vulnerable code path is only reachable under specific decoding conditions (subimage index >= 4 or a large size hint), which somewhat limits the attack surface (Red Hat Bugzilla, Red Hat Advisory).

1. Craft a malicious PCD file: Create a specially crafted Photo CD (PCD) file designed to trigger the out-of-bounds write. The file must be structured to target a PCD page/subimage index >= 4 (e.g., referenced as PCD:file[4]) or include metadata that causes GraphicsMagick to use a -size >= 1536x1024 read hint, reaching the vulnerable decode loop.
2. Deliver the file to the target: Provide the crafted PCD file to a system or application that processes images using GraphicsMagick. Since PCD files are detected by their magic bytes, the file extension does not need to match — the file can be disguised with a different extension.
3. Trigger decoding: Cause the target application to decode the PCD file using GraphicsMagick's PCD decoder. This can occur through web upload forms, email attachments processed server-side, or any automated image processing pipeline.
4. Achieve out-of-bounds write: The unbounded q++ pointer in the Huffman decode loop advances past the end of the allocated buffer, writing attacker-influenced data to adjacent heap memory, potentially corrupting allocator metadata.
5. Leverage memory corruption: Exploit the corrupted heap metadata to trigger a free() of an attacker-influenced pointer, potentially enabling further exploitation such as denial of service or, under favorable conditions, arbitrary code execution (Red Hat Bugzilla).

• Logs: Application or system logs showing crashes or segmentation faults in GraphicsMagick processes when processing PCD image files; error messages referencing PCD decoding or Huffman buffer operations.
• File System: Presence of unexpected or suspicious PCD files (detectable by magic bytes PCD regardless of file extension) in upload directories, temporary folders, or image processing queues.
• Process: Abnormal termination (SIGSEGV, SIGABRT) of GraphicsMagick worker processes; heap corruption errors reported by memory allocators (e.g., malloc: corrupted top size, double free or corruption).
• Network: Inbound delivery of files with PCD magic bytes via HTTP upload endpoints, email gateways, or file transfer services, particularly those referencing subimage indices >= 4 in processing parameters (Red Hat Bugzilla).

A patch has been tracked via Red Hat Bugzilla (Bug 2494107), and SUSE has released a security update (SUSE-SU-2026:2820-1) addressing this vulnerability in their distributions. The upstream fix over-provisions the PCD decode buffers and adds an overflow-detection check before each write. Users should update GraphicsMagick to a patched version as soon as one is available for their platform. As a workaround, restrict or disable processing of PCD image files in GraphicsMagick-based applications, particularly for untrusted input sources (Red Hat Bugzilla, SUSE Advisory).

Red Hat has tracked the vulnerability through their Bugzilla system and published a security advisory. SUSE released a security update (SUSE-SU-2026:2820-1) and openSUSE published a corresponding advisory, indicating prompt response from major Linux distribution vendors. No notable independent researcher commentary or significant social media discussion has been identified beyond vendor security channels (Red Hat Advisory, SUSE Advisory).