GraphicsMagick CVE-2026-103118

Exploitation requires that GraphicsMagick be used to parse or convert an attacker-controlled WordPerfect Graphics (WPG) file through the WPG coder path that reaches ExtractPostscript() in coders/wpg.c. The limiting factor is user/pipeline interaction (CVSS UI:P): a victim, or an automated service accepting uploaded images, must actually process the malicious file - there is no self-propagating or fully passive trigger. No authentication is needed against the file itself (PR:N), and the vector is network-reachable in the sense that the malicious file can be delivered remotely, but impact is confined to availability (a crash of the processing worker); confidentiality and integrity are unaffected. Deployments that never handle untrusted WPG input, or that sandbox/limit stack for conversion workers, face reduced practical risk.

This is a genuinely low-to-moderate real-world risk. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L, score 5.3) describes an availability-only impact (VA:L, with confidentiality and integrity explicitly N) triggered when a victim processes an attacker-supplied WPG file - the UI:P (Passive user interaction) reflects that a user or automated pipeline must be induced to open/convert the malicious file. The CWE-674 (Uncontrolled Recursion) classification is consistent with a crash/denial-of-service through stack exhaustion in ExtractPostscript() of coders/wpg.c, NOT code execution or data disclosure. Signals are consistent among themselves but NOT with the metadata: no EPSS score is provided, this is not in CISA KEV (no active exploitation), and no public exploit code is referenced - only a VulDB advisory and the vendor patch. Note a clear labeling conflict: the input Tags say 'Information Disclosure', which directly contradicts the CVSS vector (VC:N, VA:L) and the recursion CWE - this is a denial-of-service issue, not information disclosure. Overall: a real but low-severity bug worth patching in image-processing pipelines, not an urgent priority.

An attacker crafts a malformed WordPerfect Graphics (WPG) file containing structures that trigger unbounded recursion in ExtractPostscript(), then uploads or emails it to a service or user that automatically renders or converts images with GraphicsMagick. When the file is parsed, recursion exhausts the stack and crashes the worker process, causing a denial of service for that conversion job or service. No public exploit code is identified at time of analysis, though the deterministic nature of the parsing bug makes a proof-of-concept file straightforward to construct.