CVE-2026-103118 PUBLISHED

GraphicsMagick WPG File wpg.c ExtractPostscript recursion

Assigner: VulDB
Reserved: 30.09.2026 Published: 30.09.2026 Updated: 30.09.2026

A vulnerability was detected in GraphicsMagick up to 1.3.47. Affected by this vulnerability is the function ExtractPostscript of the file coders/wpg.c of the component WPG File Handler. Performing a manipulation results in uncontrolled recursion. The attack may be initiated remotely. The patch is named 627b5b1b2fc2. It is suggested to install a patch to address this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X
CVSS Score: 5.3

Product Status

Vendor n/a
Product GraphicsMagick
Versions
  • Version 1.3.0 is affected
  • Version 1.3.1 is affected
  • Version 1.3.2 is affected
  • Version 1.3.3 is affected
  • Version 1.3.4 is affected
  • Version 1.3.5 is affected
  • Version 1.3.6 is affected
  • Version 1.3.7 is affected
  • Version 1.3.8 is affected
  • Version 1.3.9 is affected
  • Version 1.3.10 is affected
  • Version 1.3.11 is affected
  • Version 1.3.12 is affected
  • Version 1.3.13 is affected
  • Version 1.3.14 is affected
  • Version 1.3.15 is affected
  • Version 1.3.16 is affected
  • Version 1.3.17 is affected
  • Version 1.3.18 is affected
  • Version 1.3.19 is affected
  • Version 1.3.20 is affected
  • Version 1.3.21 is affected
  • Version 1.3.22 is affected
  • Version 1.3.23 is affected
  • Version 1.3.24 is affected
  • Version 1.3.25 is affected
  • Version 1.3.26 is affected
  • Version 1.3.27 is affected
  • Version 1.3.28 is affected
  • Version 1.3.29 is affected
  • Version 1.3.30 is affected
  • Version 1.3.31 is affected
  • Version 1.3.32 is affected
  • Version 1.3.33 is affected
  • Version 1.3.34 is affected
  • Version 1.3.35 is affected
  • Version 1.3.36 is affected
  • Version 1.3.37 is affected
  • Version 1.3.38 is affected
  • Version 1.3.39 is affected
  • Version 1.3.40 is affected
  • Version 1.3.41 is affected
  • Version 1.3.42 is affected
  • Version 1.3.43 is affected
  • Version 1.3.44 is affected
  • Version 1.3.45 is affected
  • Version 1.3.46 is affected
  • Version 1.3.47 is affected

Credits

  • zzxzzb (VulDB User) reporter
  • VulDB CNA Team coordinator

References

Problem Types

  • Uncontrolled Recursion CWE
  • Denial of Service CWE