CVE-2026-77118: CWE-787 Out-of-bounds write in GraphicsMagick Group GraphicsMagick

The vulnerability is a heap out-of-bounds write in the PCD decoder of GraphicsMagick, specifically in the DecodeImage() function (coders/pcd.c). The Huffman delta loop increments an output pointer (q++) after each decoded delta without verifying it against the allocated buffer boundaries for luma/chroma planes. The pointer is only reset upon encountering a sync marker, so a crafted PCD file can cause the pointer to advance past the buffer end and write beyond allocated heap memory. This can lead to heap corruption when processing untrusted PCD files via GraphicsMagick commands or any linked application.

Heap memory corruption can occur when processing maliciously crafted PCD files, potentially leading to application crashes or exploitable conditions. The vulnerability affects local processing of untrusted files and requires user interaction (e.g., running gm convert or gm identify). No known exploits in the wild have been reported.

No explicit patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted PCD files with affected versions of GraphicsMagick.