8.4

CVE-2026-77118: debian graphicsmagick Out-of-bounds Write

CVSS: 8.4v4.0HighDeferred
AliasesUBUNTU-CVE-2026-77118DEBIAN-CVE-2026-77118
Published 20-08-2026Last modified 26-08-2026
Open JSON

Vulnerability summary

CVE-2026-77118 is a high (CVSS 8.4) Out-of-bounds Write vulnerability in debian graphicsmagick. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 6.1% of scored vulnerabilities.

Overall risk
34/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.4/10
010
High · v4.0 (CVE.org)
EPSS score
0.17%
0%100%
Low · +0.04 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 20-08-2026
    PublishedVulnerability first disclosed.
  2. 26-08-2026
    Last modifiedVulnerability information updated.

Description

A heap out-of-bounds write exists in the Photo CD (PCD) decoder of GraphicsMagick. In DecodeImage() (coders/pcd.c), the Huffman delta loop advances its output pointer with q++ after every decoded delta and never checks it against the end of the heap-allocated luma/chroma plane buffers. The pointer is repositioned only when a sync marker introduces a new plane/row; between sync markers the run length is bounded solely by the input. A crafted PCD file that positions the pointer near the end of a plane and then supplies a long run of deltas with no intervening sync therefore walks the pointer past the end of the allocation and writes through it. Processing an untrusted PCD file — for example with gm convert or gm identify, or through any application linked against libGraphicsMagick — can corrupt heap memory beyond the buffers.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.17%

Chance of exploitation in the next 30 days

Percentile

6%

Versus all other CVEs

30-day change

+0.04 pp

From 0.13% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.17%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Debian2 products
  • graphicsmagickAll versions (No fix recorded) | < 1.4+really1.3.48-1
  • graphicsmagick< 1.4+really1.3.48-1
Fedora project1 product
Graphicsmagick group1 product
Ubuntu1 product
  • graphicsmagickAll versions (No fix recorded)

4 vendors · 5 products

References

5 links