CVE-2026-103118

Awaiting Analysis Awaiting Analysis - Queue

Uncontrolled Recursion in GraphicsMagick WPG File Handler

Publication date: 2026-09-30

Last updated on: 2026-10-02

Assigner: VulDB

Description

A vulnerability was detected in GraphicsMagick up to 1.3.47. Affected by this vulnerability is the function ExtractPostscript of the file coders/wpg.c of the component WPG File Handler. Performing a manipulation results in uncontrolled recursion. The attack may be initiated remotely. The patch is named 627b5b1b2fc2. It is suggested to install a patch to address this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-30

Last Modified

2026-10-02

Generated

2026-10-19

AI Q&A

2026-09-30

EPSS Evaluated

2026-10-18

NVD

CVE-2026-103118

EUVD

EUVD-2026-89954

Affected Vendors & Products

Vendor	Product	Version / Range
graphicsmagick	graphicsmagick	to 1.3.47 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-404	The product does not release or incorrectly releases a resource before it is made available for re-use.
CWE-674	The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

Executive Summary

A vulnerability exists in GraphicsMagick versions up to 1.3.47 within the WPG File Handler component. The function ExtractPostscript in the file coders/wpg.c is affected by uncontrolled recursion due to a manipulation, which can be triggered remotely.

Detection Guidance

This vulnerability is related to uncontrolled recursion in the ExtractPostscript function of GraphicsMagick's WPG file handler. Detection may involve checking for GraphicsMagick versions up to 1.3.47 and analyzing logs for unusual recursion patterns in WPG file processing. No specific commands are provided in the context.

Impact Analysis

This vulnerability may lead to denial of service as uncontrolled recursion can exhaust system resources. It requires user interaction to exploit but can be initiated remotely, potentially disrupting services using affected GraphicsMagick versions.

Compliance Impact

The provided CVE data does not specify direct impacts on compliance with standards like GDPR or HIPAA. The vulnerability involves uncontrolled recursion in GraphicsMagick's WPG file handler, which could lead to denial-of-service conditions. Such issues may indirectly affect compliance by disrupting data processing or availability, but no explicit details are provided.

Mitigation Strategies

Update GraphicsMagick to version 1.3.47 or later where the patch 627b5b1b2fc2 is applied to fix the uncontrolled recursion in the WPG file handler.

Hi! I’m here to help you understand CVE-2026-103118. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70