TI-2026-65604 Aliases CVE-2026-103118 GHSA-4c5c-7x65-ccwp

GraphicsMagick WPG File wpg.c ExtractPostscript recursion

LOW 24CWE-404Published 2026-09-30 · Updated 2026-10-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · Low
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-404.

Summary

A vulnerability was detected in GraphicsMagick up to 1.3.47. Affected by this vulnerability is the function ExtractPostscript of the file coders/wpg.c of the component WPG File Handler. Performing a manipulation results in uncontrolled recursion. The attack may be initiated remotely. The patch is named 627b5b1b2fc2. It is suggested to install a patch to address this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00293 22nd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	GraphicsMagick	1.3.0; 1.3.1; 1.3.2; 1.3.3; 1.3.4; 1.3.5; 1.3.6; 1.3.7; 1.3.8; 1.3.9; 1.3.10; 1.3.11; 1.3.12; 1.3.13; 1.3.14; 1.3.15; 1.3.16; 1.3.17; 1.3.18; 1.3.19; 1.3.20; 1.3.21; 1.3.22; 1.3.23; 1.3.24; 1.3.25; 1.3.26; 1.3.27; 1.3.28; 1.3.29; 1.3.30; 1.3.31; 1.3.32; 1.3.33; 1.3.34; 1.3.35; 1.3.36; 1.3.37; 1.3.38; 1.3.39; 1.3.40; 1.3.41; 1.3.42; 1.3.43; 1.3.44; 1.3.45; 1.3.46; 1.3.47	—	No fix listed	CNA

GraphicsMagick Vendor— Affected 1.3.0; 1.3.1; 1.3.2; 1.3.3; 1.3.4; 1.3.5; 1.3.6; 1.3.7; 1.3.8; 1.3.9; 1.3.10; 1.3.11; 1.3.12; 1.3.13; 1.3.14; 1.3.15; 1.3.16; 1.3.17; 1.3.18; 1.3.19; 1.3.20; 1.3.21; 1.3.22; 1.3.23; 1.3.24; 1.3.25; 1.3.26; 1.3.27; 1.3.28; 1.3.29; 1.3.30; 1.3.31; 1.3.32; 1.3.33; 1.3.34; 1.3.35; 1.3.36; 1.3.37; 1.3.38; 1.3.39; 1.3.40; 1.3.41; 1.3.42; 1.3.43; 1.3.44; 1.3.45; 1.3.46; 1.3.47 Fixed in — No fix listed CNA

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:graphicsmagick:graphicsmagick::::::::	—	—	GraphicsMagick

cpe:2.3:a:graphicsmagick:graphicsmagick:*:*:*:*:*:*:*:* Versions — — ·GraphicsMagick

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2026-103118
2026-10-03 Alias added: GHSA-4c5c-7x65-ccwp

References

Patch 1

https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/627b5b1b2fc2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences