CVE catalog

CVE-2026-103118

Severity: Medium · CVSS 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Published: Sep 30, 2026, 1:30:05 PM UTC
Updated: Sep 30, 2026, 2:17:27 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.29% · Oct 25, 2026

A vulnerability was detected in GraphicsMagick up to 1.3.47. Affected by this vulnerability is the function ExtractPostscript of the file coders/wpg.c of the component WPG File Handler. Performing a manipulation results in uncontrolled recursion. The attack may be initiated remotely. The patch is named 627b5b1b2fc2. It is suggested to install a patch to address this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	graphicsmagick	sid	`1.4+really1.3.49-1`	fixed
Debian	graphicsmagick	forky	`1.4+really1.3.49-1`	fixed
Debian	graphicsmagick	trixie	`1.4+really1.3.45+hg17696-1`	vulnerable
Debian	graphicsmagick	bookworm	`1.4+really1.3.40-4+deb12u1`	vulnerable
Debian	graphicsmagick	bookworm-security	`1.4+really1.3.40-4+deb12u1`	vulnerable
Opensuse	GraphicsMagick	tumbleweed	`1.3.48-3.1`	fixed
Suse	GraphicsMagick	linux enterprise module for package hub 15 sp7	`1.3.42-150600.3.48.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	graphicsmagick	source	sid	`1.4+really1.3.48-2`	not yet assigned	Not reported	[1149973]
Debian	graphicsmagick	source	forky	`1.4+really1.3.48-2`	not yet assigned	Not reported	[1149973]
Debian	graphicsmagick	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1149973]
Debian	graphicsmagick	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1149973]
Opensuse	GraphicsMagick	rpm	tumbleweed	`1.3.48-3.1`	Not reported	OPENSUSE-SU-2026:12089-1	Not reported
Suse	GraphicsMagick	rpm	linux enterprise module for package hub 15 sp7	`1.3.42-150600.3.48.1`	Not reported	SUSE-SU-2026:4592-1	Not reported

[Debian bug #1149973]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[graphicsmagick]Affected
Details (4)
- 1.4+really1.3.40-4+deb12u1 · amd64 · bookworm
  Affected
  nvd · graphicsmagick · debian · bookworm; nvd · graphicsmagick · debian · 12
- 1.4+really1.3.40-4+deb12u1 · arm64 · bookworm
  Affected
  nvd · graphicsmagick · debian · bookworm; nvd · graphicsmagick · debian · 12
- 1.4+really1.3.40-4+deb12u1 · amd64 · bookworm-security
  Affected
  nvd · graphicsmagick · debian · bookworm; nvd · graphicsmagick · debian · 12
- 1.4+really1.3.40-4+deb12u1 · arm64 · bookworm-security
  Affected
  nvd · graphicsmagick · debian · bookworm; nvd · graphicsmagick · debian · 12
[graphicsmagick-dbg]Affected
Source package: [graphicsmagick]
Details (4)
- 1.4+really1.3.40-4+deb12u1 · amd64 · bookworm
  Affected
  nvd · graphicsmagick · debian · bookworm; nvd · graphicsmagick · debian · 12
- 1.4+really1.3.40-4+deb12u1 · arm64 · bookworm
  Affected
  nvd · graphicsmagick · debian · bookworm; nvd · graphicsmagick · debian · 12
- 1.4+really1.3.40-4+deb12u1 · amd64 · bookworm-security
  Affected
  nvd · graphicsmagick · debian · bookworm; nvd · graphicsmagick · debian · 12
- 1.4+really1.3.40-4+deb12u1 · arm64 · bookworm-security
  Affected
  nvd · graphicsmagick · debian · bookworm; nvd · graphicsmagick · debian · 12
[graphicsmagick-imagemagick-compat]Affected
Source package: [graphicsmagick]
Details (4)
- 1.4+really1.3.40-4+deb12u1 · all · bookworm
  Affected
  nvd · graphicsmagick · debian · bookworm; nvd · graphicsmagick · debian · 12
- 1.4+really1.3.40-4+deb12u1 · all · bookworm
  Affected
  nvd · graphicsmagick · debian · bookworm; nvd · graphicsmagick · debian · 12
- 1.4+really1.3.40-4+deb12u1 · all · bookworm-security
  Affected
  nvd · graphicsmagick · debian · bookworm; nvd · graphicsmagick · debian · 12
- 1.4+really1.3.40-4+deb12u1 · all · bookworm-security
  Affected
  nvd · graphicsmagick · debian · bookworm; nvd · graphicsmagick · debian · 12
[graphicsmagick-libmagick-dev-compat]Affected
Source package: [graphicsmagick]
Details (4)
- 1.4+really1.3.40-4+deb12u1 · all · bookworm
  Affected
  nvd · graphicsmagick · debian · bookworm; nvd · graphicsmagick · debian · 12
- 1.4+really1.3.40-4+deb12u1 · all · bookworm
  Affected
  nvd · graphicsmagick · debian · bookworm; nvd · graphicsmagick · debian · 12
- 1.4+really1.3.40-4+deb12u1 · all · bookworm-security
  Affected
  nvd · graphicsmagick · debian · bookworm; nvd · graphicsmagick · debian · 12
- 1.4+really1.3.40-4+deb12u1 · all · bookworm-security
  Affected
  nvd · graphicsmagick · debian · bookworm; nvd · graphicsmagick · debian · 12
[libgraphicsmagick++1-dev]Affected
Source package: [graphicsmagick]
Details (4)
- 1.4+really1.3.40-4+deb12u1 · amd64 · bookworm
  Affected
  nvd · graphicsmagick · debian · bookworm; nvd · graphicsmagick · debian · 12
- 1.4+really1.3.40-4+deb12u1 · arm64 · bookworm
  Affected
  nvd · graphicsmagick · debian · bookworm; nvd · graphicsmagick · debian · 12
- 1.4+really1.3.40-4+deb12u1 · amd64 · bookworm-security
  Affected
  nvd · graphicsmagick · debian · bookworm; nvd · graphicsmagick · debian · 12
- 1.4+really1.3.40-4+deb12u1 · arm64 · bookworm-security
  Affected
  nvd · graphicsmagick · debian · bookworm; nvd · graphicsmagick · debian · 12
[libgraphicsmagick1-dev]Affected
Source package: [graphicsmagick]
Details (4)
- 1.4+really1.3.40-4+deb12u1 · amd64 · bookworm
  Affected
  nvd · graphicsmagick · debian · bookworm; nvd · graphicsmagick · debian · 12
- 1.4+really1.3.40-4+deb12u1 · arm64 · bookworm
  Affected
  nvd · graphicsmagick · debian · bookworm; nvd · graphicsmagick · debian · 12
- 1.4+really1.3.40-4+deb12u1 · amd64 · bookworm-security
  Affected
  nvd · graphicsmagick · debian · bookworm; nvd · graphicsmagick · debian · 12
- 1.4+really1.3.40-4+deb12u1 · arm64 · bookworm-security
  Affected
  nvd · graphicsmagick · debian · bookworm; nvd · graphicsmagick · debian · 12
[libgraphics-magick-perl]Affected
Source package: [graphicsmagick]
Details (4)
- 1.4+really1.3.40-4+deb12u1 · amd64 · bookworm
  Affected
  nvd · graphicsmagick · debian · bookworm; nvd · graphicsmagick · debian · 12
- 1.4+really1.3.40-4+deb12u1 · arm64 · bookworm
  Affected
  nvd · graphicsmagick · debian · bookworm; nvd · graphicsmagick · debian · 12
- 1.4+really1.3.40-4+deb12u1 · amd64 · bookworm-security
  Affected
  nvd · graphicsmagick · debian · bookworm; nvd · graphicsmagick · debian · 12
- 1.4+really1.3.40-4+deb12u1 · arm64 · bookworm-security
  Affected
  nvd · graphicsmagick · debian · bookworm; nvd · graphicsmagick · debian · 12
[libgraphicsmagick++-q16-12]Affected
Source package: [graphicsmagick]
Details (4)
- 1.4+really1.3.40-4+deb12u1 · amd64 · bookworm
  Affected
  nvd · graphicsmagick · debian · bookworm; nvd · graphicsmagick · debian · 12
- 1.4+really1.3.40-4+deb12u1 · arm64 · bookworm
  Affected
  nvd · graphicsmagick · debian · bookworm; nvd · graphicsmagick · debian · 12
- 1.4+really1.3.40-4+deb12u1 · amd64 · bookworm-security
  Affected
  nvd · graphicsmagick · debian · bookworm; nvd · graphicsmagick · debian · 12
- 1.4+really1.3.40-4+deb12u1 · arm64 · bookworm-security
  Affected
  nvd · graphicsmagick · debian · bookworm; nvd · graphicsmagick · debian · 12
[libgraphicsmagick-q16-3]Affected
Source package: [graphicsmagick]
Details (4)
- 1.4+really1.3.40-4+deb12u1 · amd64 · bookworm
  Affected
  nvd · graphicsmagick · debian · bookworm; nvd · graphicsmagick · debian · 12
- 1.4+really1.3.40-4+deb12u1 · arm64 · bookworm
  Affected
  nvd · graphicsmagick · debian · bookworm; nvd · graphicsmagick · debian · 12
- 1.4+really1.3.40-4+deb12u1 · amd64 · bookworm-security
  Affected
  nvd · graphicsmagick · debian · bookworm; nvd · graphicsmagick · debian · 12
- 1.4+really1.3.40-4+deb12u1 · arm64 · bookworm-security
  Affected
  nvd · graphicsmagick · debian · bookworm; nvd · graphicsmagick · debian · 12

[Debian 13 (Trixie)]

[graphicsmagick]Affected
Details (2)
- 1.4+really1.3.45+hg17696-1 · amd64 · trixie
  Affected
  nvd · graphicsmagick · debian · 13
- 1.4+really1.3.45+hg17696-1 · arm64 · trixie
  Affected
  nvd · graphicsmagick · debian · 13
[graphicsmagick-dbg]Affected
Source package: [graphicsmagick]
Details (2)
- 1.4+really1.3.45+hg17696-1 · amd64 · trixie
  Affected
  nvd · graphicsmagick · debian · 13
- 1.4+really1.3.45+hg17696-1 · arm64 · trixie
  Affected
  nvd · graphicsmagick · debian · 13
[graphicsmagick-imagemagick-compat]Affected
Source package: [graphicsmagick]
Details (2)
- 1.4+really1.3.45+hg17696-1 · all · trixie
  Affected
  nvd · graphicsmagick · debian · 13
- 1.4+really1.3.45+hg17696-1 · all · trixie
  Affected
  nvd · graphicsmagick · debian · 13
[graphicsmagick-libmagick-dev-compat]Affected
Source package: [graphicsmagick]
Details (2)
- 1.4+really1.3.45+hg17696-1 · all · trixie
  Affected
  nvd · graphicsmagick · debian · 13
- 1.4+really1.3.45+hg17696-1 · all · trixie
  Affected
  nvd · graphicsmagick · debian · 13
[libgraphicsmagick++1-dev]Affected
Source package: [graphicsmagick]
Details (2)
- 1.4+really1.3.45+hg17696-1 · amd64 · trixie
  Affected
  nvd · graphicsmagick · debian · 13
- 1.4+really1.3.45+hg17696-1 · arm64 · trixie
  Affected
  nvd · graphicsmagick · debian · 13
[libgraphicsmagick1-dev]Affected
Source package: [graphicsmagick]
Details (2)
- 1.4+really1.3.45+hg17696-1 · amd64 · trixie
  Affected
  nvd · graphicsmagick · debian · 13
- 1.4+really1.3.45+hg17696-1 · arm64 · trixie
  Affected
  nvd · graphicsmagick · debian · 13
[libgraphics-magick-perl]Affected
Source package: [graphicsmagick]
Details (2)
- 1.4+really1.3.45+hg17696-1 · amd64 · trixie
  Affected
  nvd · graphicsmagick · debian · 13
- 1.4+really1.3.45+hg17696-1 · arm64 · trixie
  Affected
  nvd · graphicsmagick · debian · 13
[libgraphicsmagick++-q16-12t64]Affected
Source package: [graphicsmagick]
Details (2)
- 1.4+really1.3.45+hg17696-1 · amd64 · trixie
  Affected
  nvd · graphicsmagick · debian · 13
- 1.4+really1.3.45+hg17696-1 · arm64 · trixie
  Affected
  nvd · graphicsmagick · debian · 13
[libgraphicsmagick-q16-3t64]Affected
Source package: [graphicsmagick]
Details (2)
- 1.4+really1.3.45+hg17696-1 · amd64 · trixie
  Affected
  nvd · graphicsmagick · debian · 13
- 1.4+really1.3.45+hg17696-1 · arm64 · trixie
  Affected
  nvd · graphicsmagick · debian · 13

[openSUSE Tumbleweed]

[GraphicsMagick]Affected
Source package: [GraphicsMagick]
Details (1)
- 1.3.48-1.2 · x86_64 · tumbleweed
  Affected · Fixed: 1.3.48-3.1
  nvd · GraphicsMagick · opensuse · tumbleweed
[GraphicsMagick-devel]Unknown
Source package: [GraphicsMagick]
Details (1)
- 1.3.48-1.2 · x86_64 · tumbleweed
  Unknown · Fixed: 1.3.48-3.1
  Version impact unknown
  nvd · GraphicsMagick · opensuse · tumbleweed

Next results

Observed: Oct 23, 2026, 7:46:55 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]