A heap out-of-bounds write exists in the Photo CD (PCD) decoder of GraphicsMagick. In DecodeImage() (coders/pcd.c), the Huffman delta loop advances its output pointer with q++ after every decoded delta and never checks it against the end of the heap-allocated luma/chroma plane buffers. The pointer is repositioned only when a sync marker introduces a new plane/row; between sync markers the run length is bounded solely by the input. A crafted PCD file that positions the pointer near the end of a plane and then supplies a long run of deltas with no intervening sync therefore walks the pointer past the end of the allocation and writes through it. Processing an untrusted PCD file — for example with gm convert or gm identify, or through any application linked against libGraphicsMagick — can corrupt heap memory beyond the buffers.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A heap out-of-bounds write exists in the Photo CD (PCD) decoder of GraphicsMagick. In DecodeImage()
    (coders/pcd.c), the Huffman delta loop advances its output pointer with q++ after every decoded delta and
    never checks it against the end of the heap-allocated luma/chroma plane buffers. The pointer is
    repositioned only when a sync marker introduces a new plane/row; between sync markers the run length is
    bounded solely by the input. A crafted PCD file that positions the pointer near the end of a plane and
    then supplies a long run of deltas with no intervening sync therefore walks the pointer past the end of
    the allocation and writes through it. Processing an untrusted PCD file — for example with gm convert or gm
    identify, or through any application linked against libGraphicsMagick — can corrupt heap memory beyond the
    buffers. (CVE-2026-77118)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A heap out-of-bounds write exists in the Photo CD (PCD) decoder of GraphicsMagick. In DecodeImage()     (coders/pcd.c), the Huffman delta loop advances its output pointer with q++ after every decoded delta and     never checks it against the end of the heap-allocated luma/chroma plane buffers. The pointer is     repositioned only when a sync marker introduces a new plane/row; between sync markers the run length is     bounded solely by the input. A crafted PCD file that positions the pointer near the end of a plane and     then supplies a long run of deltas with no intervening sync therefore walks the pointer past the end of     the allocation and writes through it. Processing an untrusted PCD file  for example with gm convert or gm     identify, or through any application linked against libGraphicsMagick  can corrupt heap memory beyond the     buffers. (CVE-2026-77118)

Note that Nessus relies on the presence of the package as reported by the vendor.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1960 advisory.

    A flaw was found in GraphicsMagick's Photo CD (PCD) decoder. A remote attacker could exploit this     vulnerability by providing a specially crafted PCD file. This could lead to an out-of-bounds write,     corrupting memory and potentially causing a denial of service or other unpredictable system behavior.
    (CVE-2026-13606)

    A heap out-of-bounds write exists in the Photo CD (PCD) decoder of GraphicsMagick. In DecodeImage()     (coders/pcd.c), the Huffman delta loop advances its output pointer with q++ after every decoded delta and     never checks it against the end of the heap-allocated luma/chroma plane buffers. The pointer is     repositioned only when a sync marker introduces a new plane/row; between sync markers the run length is     bounded solely by the input.



    A crafted PCD file that positions the pointer near the end of a plane and then supplies a long run of     deltas with no intervening sync therefore walks the pointer past the end of the allocation and writes     through it. Processing an untrusted PCD file -- for example with gm convert or gm identify, or through any     application linked against libGraphicsMagick -- can corrupt heap memory beyond the buffers.
    (CVE-2026-77118)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of GraphicsMagick installed on the remote host is prior to 1.3.45-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2GRAPHICSMAGICK1.3-2026-005 advisory.

    A flaw was found in GraphicsMagick's Photo CD (PCD) decoder. A remote attacker could exploit this     vulnerability by providing a specially crafted PCD file. This could lead to an out-of-bounds write,     corrupting memory and potentially causing a denial of service or other unpredictable system behavior.
    (CVE-2026-13606)

    A heap out-of-bounds write exists in the Photo CD (PCD) decoder of GraphicsMagick. In DecodeImage()     (coders/pcd.c), the Huffman delta loop advances its output pointer with q++ after every decoded delta and     never checks it against the end of the heap-allocated luma/chroma plane buffers. The pointer is     repositioned only when a sync marker introduces a new plane/row; between sync markers the run length is     bounded solely by the input.



    A crafted PCD file that positions the pointer near the end of a plane and then supplies a long run of     deltas with no intervening sync therefore walks the pointer past the end of the allocation and writes     through it. Processing an untrusted PCD file -- for example with gm convert or gm identify, or through any     application linked against libGraphicsMagick -- can corrupt heap memory beyond the buffers.
    (CVE-2026-77118)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
457766	Echo: graphicsmagick: security update to 1.4+really1.3.45+hg17696-1+e1	Tenable Cloud Security	Echo Local Security Checks	Local	high
457766	Echo: graphicsmagick: security update to 1.4+really1.3.45+hg17696-1+e1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
338452	Linux Distros Unpatched Vulnerability : CVE-2026-77118	Nessus	Misc.	Local	high
328501	Amazon Linux 2023 : GraphicsMagick, GraphicsMagick-c++, GraphicsMagick-c++-devel (ALAS2023-2026-1960)	Nessus	Amazon Linux Local Security Checks	Local	high
328463	Amazon Linux 2 : GraphicsMagick (ALASGRAPHICSMAGICK1.3-2026-005)	Nessus	Amazon Linux Local Security Checks	Local	high

Detections

Analytics

CVE-2026-77118

high

Tenable Plugins

high

high

high

high

high