GraphicsMagick Group vulnerabilities and threats

CVE-2026-77118 is a heap out-of-bounds write vulnerability in the Photo CD (PCD) decoder of GraphicsMagick. The flaw occurs in the DecodeImage() function where the output pointer advances without proper boundary checks, potentially leading to heap memory corruption when processing crafted PCD files. This affects GraphicsMagick versions from 0 up to but not including 1.3.48. The vulnerability has a high severity score of 8.4 CVSS v4.0.