# CVE-2026-103118: GraphicsMagick uncontrolled recursion in WPG file handler

Source: https://junglewise.ai/threats/cve-2026-103118-a-vulnerability-was-detected-in-graphicsmagick-up-to-1-3-47  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-30. Updated: 2026-09-30  
License: CC BY 4.0 with a link back

CVE-2026-103118 · Severity: medium · CVSS 4.3 · Published 2026-09-30

GraphicsMagick is an image processing library used to convert and manipulate images. A flaw in its WPG file handler allows an attacker to trigger uncontrolled recursion by sending a specially crafted WPG file, potentially causing a denial of service. The vendor has already released a patch addressing this issue.

Technologies: [Graphicsmagick](https://junglewise.ai/threats/technologies/graphicsmagick). Vendors: [Graphicsmagick](https://junglewise.ai/threats/vendors/graphicsmagick).

## Quick answers

**Is CVE-2026-103118 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-103118 being exploited in the wild.

**How severe is CVE-2026-103118?** Medium severity, with a CVSS score of 4.3, published 30 September 2026.

**Which products and versions are affected?** Graphicsmagick up to 1.3.47.

**Is there a fix for CVE-2026-103118?** A patch was published on 2026-09-30: Patch 627b5b1b2fc2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-103118 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-103118?** Check whether you run Graphicsmagick at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The ExtractPostscript function in coders/wpg.c of GraphicsMagick fails to properly limit recursion depth when processing WPG files, allowing an attacker to craft a malicious file that triggers stack exhaustion. The vulnerability can be exploited remotely by sending a specially crafted WPG file to an application using the affected library. A fix is available in commit 627b5b1b2fc2.

## Affected products

- GraphicsMagick GraphicsMagick up to 1.3.47

## Timeline

- 2026-09-30: disclosed
- 2026-09-30: patched: Patch 627b5b1b2fc2 released

## References

- [https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/627b5b1b2fc2](https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/627b5b1b2fc2)
- [https://vuldb.com/cve/CVE-2026-103118](https://vuldb.com/cve/CVE-2026-103118)

## Related threats

- [GraphicsMagick heap out-of-bounds write in PCD decoder](https://junglewise.ai/threats/cve-2026-77118-graphicsmagick-heap-out-of-bounds-write-in-pcd-decoder)
- [GraphicsMagick NULL pointer dereference in WPG reader](https://junglewise.ai/threats/cve-2016-7997-graphicsmagick-null-pointer-dereference-in-wpg-reader)
- [GraphicsMagick heap overflow in WPG format reader](https://junglewise.ai/threats/cve-2016-7996-graphicsmagick-heap-overflow-in-wpg-format-reader)