CVE-2026-77118: Out-of-bounds write in GraphicsMagick PCD decoder
A heap out-of-bounds write exists in the Photo CD (PCD) decoder of GraphicsMagick. In DecodeImage() (coders/pcd.c), the Huffman delta loop advances its output pointer with q++ after every decoded delta and never checks it against the end of the heap-allocated luma/chroma plane buffers. The pointer is repositioned only when a sync marker introduces a new plane/row; between sync markers the run length is bounded solely by the input.
A crafted PCD file that positions the pointer near the end of a plane and then supplies a long run of deltas with no intervening sync therefore walks the pointer past the end of the allocation and writes through it. Processing an untrusted PCD file — for example with gm convert or gm identify, or through any application linked against libGraphicsMagick — can corrupt heap memory beyond the buffers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GraphicsMagickto a version that resolves this vulnerability.Fixed in 1.3.48
Event History
Frequently Asked Questions
Who is exposed to this issue?
Any environment that processes untrusted Photo CD (PCD) files using GraphicsMagick is exposed. This includes command-line uses such as gm convert and gm identify, as well as applications linked against libGraphicsMagick.
What does an attacker need to exploit it?
An attacker needs to provide a crafted PCD file that places the decoder output pointer near the end of a luma or chroma plane and supplies a long sequence of Huffman deltas without a sync marker. The vulnerable decoder then writes beyond the heap-allocated plane buffer.
How can I tell whether an affected workflow is at risk?
Identify systems that accept, scan, convert, identify, preview, or otherwise decode PCD files through GraphicsMagick or libGraphicsMagick. Workflows that never process PCD input are not exposed through the described decoder path.
What can be done if patching cannot happen immediately?
Do not process untrusted PCD files with GraphicsMagick or applications using libGraphicsMagick. Where PCD support is not required, block or reject PCD input until the fix can be deployed.