Description
A vulnerability was detected in GraphicsMagick up to 1.3.47. Affected by this vulnerability is the function ExtractPostscript of the file coders/wpg.c of the component WPG File Handler. Performing a manipulation results in uncontrolled recursion. The attack may be initiated remotely. The patch is named 627b5b1b2fc2. It is suggested to install a patch to address this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | GraphicsMagick | 1.3.0, 1.3.1, 1.3.2, 1.3.3, 1.3.4, 1.3.5, 1.3.6, 1.3.7, 1.3.8, 1.3.9, 1.3.10, 1.3.11, 1.3.12, 1.3.13, 1.3.14, 1.3.15, 1.3.16, 1.3.17, 1.3.18, 1.3.19, 1.3.20, 1.3.21, 1.3.22, 1.3.23, 1.3.24, 1.3.25, 1.3.26, 1.3.27, 1.3.28, 1.3.29, 1.3.30, 1.3.31, 1.3.32, 1.3.33, 1.3.34, 1.3.35, 1.3.36, 1.3.37, 1.3.3… | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | graphicsmagick | 1.4+really1.3.48-2 | — |
| Debian 13 | graphicsmagick | No fix yet | — |
| Debian 12 | graphicsmagick | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | graphicsmagick | No fix yet | — |
| Ubuntu 26.04 LTS | graphicsmagick | No fix yet | — |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | graphicsmagick | No fix yet | — |
| Ubuntu Pro 22.04 LTS | graphicsmagick | No fix yet | — |
| Ubuntu Pro 20.04 LTS | graphicsmagick | No fix yet | — |
| Ubuntu Pro 18.04 LTS | graphicsmagick | No fix yet | — |
| Ubuntu Pro 16.04 LTS | graphicsmagick | No fix yet | — |
| Ubuntu Pro 14.04 LTS | graphicsmagick | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | GraphicsMagick | 1.3.42-150600.3.48.1 | SUSE-SU-2026:4592-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | GraphicsMagick | 1.3.48-3.1 | openSUSE-SU-2026:12089-1 |
| openSUSE Leap 16.0 | GraphicsMagick | 1.3.45-160000.14.1 | openSUSE-SU-2026:22239-1 |
Advisories 4
- openSUSE-SU-2026:22239-1 Security update for GraphicsMagick SUSE / openSUSE Security Updates · Nov 11, 2026
- WID-SEC-2026-3677 GraphicsMagick: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Nov 10, 2026
- openSUSE-SU-2026:12089-1 GraphicsMagick-1.3.48-3.1 on GA media SUSE / openSUSE Security Updates · Oct 10, 2026
- SUSE-SU-2026:4592-1 Security update for GraphicsMagick SUSE / openSUSE Security Updates · Oct 9, 2026
References
- VDB-411874 | GraphicsMagick WPG File wpg.c ExtractPostscript recursion vdb-entry technical-description
- VDB-411874 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- CVE-2026-103118 | CVE Analysis and Report third-party-advisory
- Submit #954970 | Graphicsmagick 1.3.47 and prior; fixed in development changeset 627b5b1b2fc2 (2026-08-24), not yet in any release Uncontrolled Recursion third-party-advisory
- https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/627b5b1b2fc2 patch