GraphicsMagick EUVD-2026-63345

The vulnerability is triggered whenever a crafted PCD file reaches the DecodeImage() function in coders/pcd.c; no special GraphicsMagick configuration is required - the PCD decoder is enabled in a standard build. The CVSS 4.0 vector specifies PR:N (no privileges needed to supply the file) and UI:A (a user or automated process must actively invoke PCD decoding, e.g., via gm convert input.pcd, gm identify input.pcd, or an application calling libGraphicsMagick). In server-side pipelines that automatically process user-uploaded images the UI:A barrier is effectively removed. Exploitation is limited by: (1) the attacker must be able to deliver a PCD-format file into the processing path - pipelines that filter by extension or magic bytes before decoding reduce exposure; (2) the local attack vector (AV:L) means the file must reach the local processing environment rather than being exploitable directly over a network protocol; (3) modern heap mitigations (ASLR, safe-unlinking, guard pages) make reliable code execution harder, though denial-of-service via crash is straightforward.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:A) scores 8.4, reflecting a local file-processing attack requiring active user interaction but no privileges. The high VC/VI/VA metrics are well-justified: heap out-of-bounds writes in image decoders are a historically well-exploited vulnerability class capable of producing both reliable denial-of-service and, with heap-layout control, code execution. EPSS data is absent from the provided intelligence, and neither CISA KEV listing nor public proof-of-concept code has been identified at time of analysis, so real-world exploitation probability is currently speculative. The local attack vector (AV:L) and UI:A requirement temper risk in interactive desktop contexts, but server-side image-processing pipelines that automatically ingest user-supplied files effectively eliminate the human-interaction barrier, making this a meaningful priority for any deployment that accepts PCD-format uploads. Modern heap hardening (ASLR, safe-unlinking, guard pages) raises the bar for reliable code execution while leaving crash-based denial-of-service readily achievable.

An attacker delivers a specially crafted PCD image to a web application or API endpoint that passes uploaded files through gm convert or a libGraphicsMagick-linked processor. When the application decodes the file, DecodeImage() enters the Huffman delta loop and - due to the absent bounds check - writes delta values past the end of the heap plane buffer; with no POC confirmed, the most predictable outcome is a crash, but heap-layout manipulation could plausibly yield code execution in the context of the image-processing service.