Executive brief
GraphicsMagick is a widely-used image manipulation library and command-line tool. A malicious Photo CD (PCD) image file can trigger a heap memory write beyond allocated buffer boundaries, potentially corrupting application memory and leading to denial of service or code execution. This vulnerability affects applications processing untrusted image files via GraphicsMagick's conversion or identification tools.
Technical details
A heap out-of-bounds write vulnerability exists in the Photo CD decoder (coders/pcd.c), specifically in the DecodeImage() Huffman delta loop. The vulnerability occurs because the output pointer (q) is incremented after every decoded delta without validation against buffer boundaries; pointer repositioning only happens at sync markers. A crafted PCD file positioning the pointer near buffer end, followed by a long run-length sequence with no intervening sync markers, allows the pointer to advance past the allocated luma/chroma plane buffers and write arbitrary data to adjacent heap memory. Attack vector is network or local (via file processing); no authentication is required. An attacker can corrupt heap memory, trigger crash (DoS), or potentially achieve code execution depending on heap layout and exploitation conditions. Patch status is unknown from the advisory text.
Affected products
- GraphicsMagick GraphicsMagick <UNKNOWN>
Timeline
- 2026-08-20: disclosed