It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1960 advisory.

    A flaw was found in GraphicsMagick's Photo CD (PCD) decoder. A remote attacker could exploit this     vulnerability by providing a specially crafted PCD file. This could lead to an out-of-bounds write,     corrupting memory and potentially causing a denial of service or other unpredictable system behavior.
    (CVE-2026-13606)

    A heap out-of-bounds write exists in the Photo CD (PCD) decoder of GraphicsMagick. In DecodeImage()     (coders/pcd.c), the Huffman delta loop advances its output pointer with q++ after every decoded delta and     never checks it against the end of the heap-allocated luma/chroma plane buffers. The pointer is     repositioned only when a sync marker introduces a new plane/row; between sync markers the run length is     bounded solely by the input.



    A crafted PCD file that positions the pointer near the end of a plane and then supplies a long run of     deltas with no intervening sync therefore walks the pointer past the end of the allocation and writes     through it. Processing an untrusted PCD file -- for example with gm convert or gm identify, or through any     application linked against libGraphicsMagick -- can corrupt heap memory beyond the buffers.
    (CVE-2026-77118)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Amazon Linux 2023 : GraphicsMagick, GraphicsMagick-c++, GraphicsMagick-c++-devel (ALAS2023-2026-1960)

high Nessus Plugin ID 328501

Version 1.2

Version 1.1

Version 1.2 Aug 29, 2026, 5:36 AM CVE (set "CVE" coverage to "CVE-2026-13606,CVE-2026-77118") CVSS metrics ("Cvssv4 score" set to 8.4) CVSS metrics ("Cvssv4 threat vector" set to "CVSS:4.0/E:U") CVSS metrics ("Cvssv4 vector" set to "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N") Plugin metadata Plugin Feed: 202608290536
Version 1.1 Jul 21, 2026, 8:31 PM New Plugin Feed: 202607212031