GraphicsMagick PCD decoder heap OOB write
CVE-2026-77118 Published on August 20, 2026
Out-of-bounds write in GraphicsMagick PCD decoder
A heap out-of-bounds write exists in the Photo CD (PCD) decoder of GraphicsMagick. In DecodeImage() (coders/pcd.c), the Huffman delta loop advances its output pointer with q++ after every decoded delta and never checks it against the end of the heap-allocated luma/chroma plane buffers. The pointer is repositioned only when a sync marker introduces a new plane/row; between sync markers the run length is bounded solely by the input.
A crafted PCD file that positions the pointer near the end of a plane and then supplies a long run of deltas with no intervening sync therefore walks the pointer past the end of the allocation and writes through it. Processing an untrusted PCD file for example with gm convert or gm identify, or through any application linked against libGraphicsMagick can corrupt heap memory beyond the buffers.
Vulnerability Analysis
CVE-2026-77118 is exploitable with local system access. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
What is a Memory Corruption Vulnerability?
The software writes data past the end, or before the beginning, of the intended buffer. Typically, this can result in corruption of data, a crash, or code execution. The software may modify an index or perform pointer arithmetic that references a memory location that is outside of the boundaries of the buffer. A subsequent write operation then produces undefined or unexpected results.
CVE-2026-77118 has been classified to as a Memory Corruption vulnerability or weakness.
Products Associated with CVE-2026-77118
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-77118 are published in these products:
Affected Versions
GraphicsMagick Group GraphicsMagick:- Version 1.0.0 and below 1.3.48 is affected.
- Before 1.4+really1.3.48-1 is affected.
- Before 1.3.48 is affected.