CVE-2026-77118: 
GraphicsMagick vulnerability analysis and mitigation

CVE-2026-77118 is a heap out-of-bounds write vulnerability in the Photo CD (PCD) decoder of GraphicsMagick, classified as High severity. The flaw exists in the DecodeImage() function within coders/pcd.c, where the Huffman delta loop increments an output pointer without bounds checking against the end of heap-allocated luma/chroma plane buffers. All GraphicsMagick versions from 1.0.0 up to (but not including) 1.3.48 are affected, as are corresponding Debian and Fedora packages prior to their respective patched releases. The vulnerability was published on August 20, 2026, with a patch available in GraphicsMagick 1.3.48. It carries a CVSS v4.0 base score of 8.4 (High) (GitHub Advisory).

The root cause is an out-of-bounds write (CWE-787) in DecodeImage() (coders/pcd.c). During Huffman delta decoding of PCD image data, the output pointer q is incremented with q++ after each decoded delta value, but is never validated against the end of the heap-allocated luma or chroma plane buffer. The pointer is only repositioned when a sync marker signals a new plane or row; between sync markers, the number of iterations is controlled entirely by attacker-supplied input. A crafted PCD file can position the pointer near the end of a buffer allocation and then supply a long run of deltas without any intervening sync marker, causing the pointer to walk past the allocation boundary and write arbitrary data to adjacent heap memory. Exploitation requires a user or application to process a malicious PCD file — for example via gm convert, gm identify, or any application linked against libGraphicsMagick (GitHub Advisory).

Successful exploitation allows an attacker to corrupt heap memory beyond the intended buffer boundaries, potentially enabling arbitrary code execution in the context of the process handling the malicious PCD file. The vulnerable system impact includes high confidentiality, integrity, and availability consequences, as heap corruption can be leveraged to overwrite adjacent allocations, control program flow, or cause a crash. Applications that automatically process user-supplied image files (e.g., web services, document converters, or media pipelines using libGraphicsMagick) are at elevated risk, as exploitation requires only that a malicious PCD file be processed (GitHub Advisory).

As of the disclosure date (August 20, 2026), there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — specifically, a victim application or user must process a crafted PCD file — which somewhat limits the attack surface compared to fully remote, zero-interaction vulnerabilities. No EPSS score data was available in the provided sources (GitHub Advisory).

1. Craft a malicious PCD file: Create a specially crafted Photo CD (PCD) file that positions the Huffman decoder's output pointer near the end of a heap-allocated luma or chroma plane buffer. This involves structuring the PCD data so that the initial sync markers place the pointer close to the buffer boundary.
2. Suppress sync markers: Append a long sequence of Huffman-encoded delta values with no intervening sync markers, so the decoder's q++ loop iterates past the end of the allocated buffer without repositioning.
3. Deliver the file to the target: Provide the crafted PCD file to a target application that uses GraphicsMagick for image processing — for example, by uploading it to a web service, sending it as an email attachment, or placing it in a directory monitored by an automated pipeline.
4. Trigger processing: Cause the target application to process the file, e.g., via gm convert malicious.pcd output.png or gm identify malicious.pcd, or through any application linked against libGraphicsMagick.
5. Achieve heap corruption: The out-of-bounds write corrupts adjacent heap memory. Depending on heap layout and allocator behavior, this may overwrite heap metadata, function pointers, or other sensitive structures, potentially enabling arbitrary code execution in the context of the processing application (GitHub Advisory).

• Process: Unexpected crashes or segmentation faults in processes running gm convert, gm identify, or applications linked against libGraphicsMagick when processing PCD image files.
• Logs: Application error logs showing heap corruption errors, memory access violations, or abnormal termination signals (e.g., SIGSEGV, SIGABRT) originating from coders/pcd.c or DecodeImage().
• File System: Presence of unexpected or anomalous .pcd files in directories monitored by image processing pipelines, especially files with unusual sizes or structures.
• Network: Inbound delivery of .pcd files via web upload endpoints, email, or file transfer services to systems running GraphicsMagick-based processing pipelines.

Update GraphicsMagick to version 1.3.48 or later, which contains the fix committed at 937cdd9920bd96 in the upstream repository. For Debian, upgrade to 1.4+really1.3.48-1 or later; for Fedora, upgrade to the patched RPM version 1.3.48 or later. As an interim workaround, restrict or disable processing of untrusted PCD files, and disable PCD format support in GraphicsMagick if it is not required by the application. Monitor applications using GraphicsMagick for crashes or unexpected behavior when handling image files (GitHub Advisory).