EUVD-2026-63345
GHSA-qjrj-qxx7-fc4j
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
File-local attack vector with required user interaction; no privileges needed to supply input; heap write yields full CIA impact on the vulnerable process.
Primary rating from Vendor (22e2d327-25fe-45d7-9f0c-dcd23b7108df).
CVSS VectorVendor: 22e2d327-25fe-45d7-9f0c-dcd23b7108df
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A heap out-of-bounds write exists in the Photo CD (PCD) decoder of GraphicsMagick. In DecodeImage() (coders/pcd.c), the Huffman delta loop advances its output pointer with q++ after every decoded delta and never checks it against the end of the heap-allocated luma/chroma plane buffers. The pointer is repositioned only when a sync marker introduces a new plane/row; between sync markers the run length is bounded solely by the input.
A crafted PCD file that positions the pointer near the end of a plane and then supplies a long run of deltas with no intervening sync therefore walks the pointer past the end of the allocation and writes through it. Processing an untrusted PCD file - for example with gm convert or gm identify, or through any application linked against libGraphicsMagick - can corrupt heap memory beyond the buffers.
AnalysisAI
Heap out-of-bounds write in GraphicsMagick's Photo CD (PCD) decoder enables heap memory corruption when processing a maliciously crafted PCD image. The DecodeImage() function in coders/pcd.c unconditionally advances its output pointer (q++) on every decoded Huffman delta without validating it against the end of the heap-allocated luma or chroma plane buffers, so an attacker-controlled PCD file can drive the pointer arbitrarily past the allocation boundary and overwrite adjacent heap memory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The vulnerability is triggered whenever a crafted PCD file reaches the DecodeImage() function in coders/pcd.c; no special GraphicsMagick configuration is required - the PCD decoder is enabled in a standard build. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:A) scores 8.4, reflecting a local file-processing attack requiring active user interaction but no privileges. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker delivers a specially crafted PCD image to a web application or API endpoint that passes uploaded files through gm convert or a libGraphicsMagick-linked processor. When the application decodes the file, DecodeImage() enters the Huffman delta loop and - due to the absent bounds check - writes delta values past the end of the heap plane buffer; with no POC confirmed, the most predictable outcome is a crash, but heap-layout manipulation could plausibly yield code execution in the context of the image-processing service. |
| Remediation | Upgrade GraphicsMagick to version 1.3.48, which contains the upstream fix at commit 937cdd9920bd96 (https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/937cdd9920bd96); review the 1.3.48 ChangeLog at https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/raw/GraphicsMagick-1_3_48/ChangeLog to confirm patch inclusion. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems and applications using GraphicsMagick (including gm convert, gm identify utilities, and systems dynamically linking libGraphicsMagick) to identify which handle Photo CD (.pcd) files or accept user-uploaded images. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today