CVE-2026-77118

NameCVE-2026-77118
DescriptionA heap out-of-bounds write exists in the Photo CD (PCD) decoder of GraphicsMagick. In DecodeImage() (coders/pcd.c), the Huffman delta loop advances its output pointer with q++ after every decoded delta and never checks it against the end of the heap-allocated luma/chroma plane buffers. The pointer is repositioned only when a sync marker introduces a new plane/row; between sync markers the run length is bounded solely by the input. A crafted PCD file that positions the pointer near the end of a plane and then supplies a long run of deltas with no intervening sync therefore walks the pointer past the end of the allocation and writes through it. Processing an untrusted PCD file — for example with gm convert or gm identify, or through any application linked against libGraphicsMagick — can corrupt heap memory beyond the buffers.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
graphicsmagick (PTS)bullseye (security), bullseye1.4+really1.3.36+hg16481-2+deb11u1vulnerable
bookworm, bookworm (security)1.4+really1.3.40-4+deb12u1vulnerable
trixie1.4+really1.3.45+hg17696-1vulnerable
forky, sid1.4+really1.3.48-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
graphicsmagicksource(unstable)1.4+really1.3.48-1

Notes

Fixed by: https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/937cdd9920bd966517c5f7a3595397af96b6ab6f (GraphicsMagick-1_3_48)

Search for package or bug name: Reporting problems