GraphicsMagick Group GraphicsMagick PCD decoder heap out-of-bounds write

A heap out-of-bounds write exists in the Photo CD (PCD) decoder of GraphicsMagick. In DecodeImage() (coders/pcd.c), the Huffman delta loop advances its output pointer with q++ after every decoded delta and never checks it against the end of the heap-allocated luma/chroma plane buffers. The pointer is repositioned only when a sync marker introduces a new plane/row; between sync markers the run length is bounded solely by the input. A crafted PCD file that positions the pointer near the end of a plane and then supplies a long run of deltas with no intervening sync therefore walks the pointer past the end of the allocation and writes through it. Processing an untrusted PCD file, for example with gm convert or gm identify, or through any application linked against libGraphicsMagick, can corrupt heap memory beyond the buffers.

• GraphicsMagick Group GraphicsMagick: affected from 1.0.0 through versions less than 1.3.48 under semver. The relevant component is the PCD / PCDS image coder.
• Debian, graphicsmagick package: affected from 0 through versions less than 1.4+really1.3.48-1 under Debian versioning. The record associates this range with Debian 11, Debian 12, and Debian 13.
• Fedora Project, GraphicsMagick package: affected from 0 through versions less than 1.3.48 under RPM versioning. The record associates this range with Extra Packages for Enterprise Linux 8 and 9.
• Branches, packages, or configurations outside these ranges are not confirmed by the record to be affected or unaffected.

The flaw is in the Photo CD decoder, including the PCD and PCDS image coder, at DecodeImage() in coders/pcd.c. The Huffman delta loop advances the output pointer with q++ after each decoded delta but does not check the pointer against the end of the heap-allocated luma and chroma plane buffers. The pointer is repositioned only when a sync marker introduces a new plane or row, so between sync markers the number of writes is bounded only by the input. A crafted PCD file can place the pointer near the end of a plane and then provide a long sequence of deltas without an intervening sync marker, causing writes beyond the allocation. This is a CWE-787 out-of-bounds write, but the record does not establish whether the resulting memory corruption can lead to code execution.

The flaw can be triggered when a PCD file is processed locally by gm convert, gm identify, or an application linked against libGraphicsMagick. The record describes active user interaction, no required privileges, and low attack complexity. Network reachability is not established independently, although an upload-processing service could provide an indirect path if it accepts and processes untrusted PCD files. The record does not identify a public exploit, and known_exploited does not confirm observed exploitation. These fields do not prove that exploitation has never occurred.

When a PCD file is processed, Huffman delta data can cause the write pointer to move beyond the end of a heap-allocated plane buffer. The direct result is a write outside the allocation, which may crash the process, corrupt data, or alter process state. The record characterizes the attack as local, requiring no privileges, with low complexity and active user interaction. Serious confidentiality, integrity, and availability consequences are possible, but code execution and crossing a privilege boundary are not confirmed. Impact beyond the image-processing process is not established.

The flaw affects manual or automated workflows that accept and decode untrusted PCD files. A heap out-of-bounds write can terminate an image-processing process, corrupt adjacent data, or reduce the availability of an image-processing service. Depending on heap state and process protections, confidentiality or integrity impacts are also possible, but the record does not confirm a specific compromise scenario. Systems that process only trusted and tightly controlled PCD data should still be checked to determine whether they contain the affected component.

1. Upgrade GraphicsMagick to 1.3.48, the upstream fixed release identified in the record. The fix bounds the decoder output pointer against the end of each plane buffer and over-provisions the buffers.
2. For Debian, deploy the package corresponding to the 1.4+really1.3.48-1 fixed boundary or a distributor update that contains this fix.
3. For Fedora Project, deploy the package corresponding to the 1.3.48 fixed boundary or a distributor update that contains this fix.
4. Check and restart or redeploy applications that statically or dynamically link against libGraphicsMagick after updating the library.
5. Until updating is possible, restrict processing of untrusted PCD files in affected workflows where operationally feasible. The record does not provide a specific configuration option for disabling only the PCD decoder.

1. Inventory servers, command-line tools, and applications that embed or link against GraphicsMagick, especially systems that process PCD or PCDS files.
2. Check package metadata and installed versions, then compare them with the affected and fixed boundaries listed in affected_summary.
3. Identify workflows that accept files from untrusted sources and pass them to gm convert, gm identify, or libGraphicsMagick.
4. Review crashes, abnormal exits, or heap-corruption detections in image-processing processes after PCD handling. This is precautionary monitoring, not a confirmed indicator of compromise.
5. No specific log event, file signature, or IOC is provided. The absence of such evidence does not prove that a system is safe.