CVE-2026-103118
Received Received - Intake

Uncontrolled Recursion in GraphicsMagick WPG File Handler

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: VulDB

Description
A vulnerability was detected in GraphicsMagick up to 1.3.47. Affected by this vulnerability is the function ExtractPostscript of the file coders/wpg.c of the component WPG File Handler. Performing a manipulation results in uncontrolled recursion. The attack may be initiated remotely. The patch is named 627b5b1b2fc2. It is suggested to install a patch to address this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-30
Last Modified
2026-09-30
Generated
2026-09-30
AI Q&A
2026-09-30
EPSS Evaluated
N/A
NVD
CVE-2026-103118
EUVD
EUVD-2026-89954

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
graphicsmagick graphicsmagick to 1.3.47 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-404 The product does not release or incorrectly releases a resource before it is made available for re-use.
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

A vulnerability exists in GraphicsMagick versions up to 1.3.47 within the WPG File Handler component. The function ExtractPostscript in the file coders/wpg.c is affected by uncontrolled recursion due to a manipulation, which can be triggered remotely.

Impact Analysis

This vulnerability may lead to denial of service as uncontrolled recursion can exhaust system resources. It requires user interaction to exploit but can be initiated remotely, potentially disrupting services using affected GraphicsMagick versions.

Mitigation Strategies

Update GraphicsMagick to version 1.3.47 or later where the patch 627b5b1b2fc2 is applied to fix the uncontrolled recursion in the WPG file handler.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103118. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart