{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-103118", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-09-30T05:57:03.831Z", "datePublished": "2026-09-30T13:30:05.945Z", "dateUpdated": "2026-10-02T16:13:17.749Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-09-30T13:30:05.945Z"}, "title": "GraphicsMagick WPG File wpg.c ExtractPostscript recursion", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-674", "lang": "en", "description": "Uncontrolled Recursion"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-404", "lang": "en", "description": "Denial of Service"}]}], "affected": [{"vendor": "n/a", "product": "GraphicsMagick", "versions": [{"version": "1.3.0", "status": "affected"}, {"version": "1.3.1", "status": "affected"}, {"version": "1.3.2", "status": "affected"}, {"version": "1.3.3", "status": "affected"}, {"version": "1.3.4", "status": "affected"}, {"version": "1.3.5", "status": "affected"}, {"version": "1.3.6", "status": "affected"}, {"version": "1.3.7", "status": "affected"}, {"version": "1.3.8", "status": "affected"}, {"version": "1.3.9", "status": "affected"}, {"version": "1.3.10", "status": "affected"}, {"version": "1.3.11", "status": "affected"}, {"version": "1.3.12", "status": "affected"}, {"version": "1.3.13", "status": "affected"}, {"version": "1.3.14", "status": "affected"}, {"version": "1.3.15", "status": "affected"}, {"version": "1.3.16", "status": "affected"}, {"version": "1.3.17", "status": "affected"}, {"version": "1.3.18", "status": "affected"}, {"version": "1.3.19", "status": "affected"}, {"version": "1.3.20", "status": "affected"}, {"version": "1.3.21", "status": "affected"}, {"version": "1.3.22", "status": "affected"}, {"version": "1.3.23", "status": "affected"}, {"version": "1.3.24", "status": "affected"}, {"version": "1.3.25", "status": "affected"}, {"version": "1.3.26", "status": "affected"}, {"version": "1.3.27", "status": "affected"}, {"version": "1.3.28", "status": "affected"}, {"version": "1.3.29", "status": "affected"}, {"version": "1.3.30", "status": "affected"}, {"version": "1.3.31", "status": "affected"}, {"version": "1.3.32", "status": "affected"}, {"version": "1.3.33", "status": "affected"}, {"version": "1.3.34", "status": "affected"}, {"version": "1.3.35", "status": "affected"}, {"version": "1.3.36", "status": "affected"}, {"version": "1.3.37", "status": "affected"}, {"version": "1.3.38", "status": "affected"}, {"version": "1.3.39", "status": "affected"}, {"version": "1.3.40", "status": "affected"}, {"version": "1.3.41", "status": "affected"}, {"version": "1.3.42", "status": "affected"}, {"version": "1.3.43", "status": "affected"}, {"version": "1.3.44", "status": "affected"}, {"version": "1.3.45", "status": "affected"}, {"version": "1.3.46", "status": "affected"}, {"version": "1.3.47", "status": "affected"}], "cpes": ["cpe:2.3:a:graphicsmagick:graphicsmagick:*:*:*:*:*:*:*:*"], "modules": ["WPG File Handler"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in GraphicsMagick up to 1.3.47. Affected by this vulnerability is the function ExtractPostscript of the file coders/wpg.c of the component WPG File Handler. Performing a manipulation results in uncontrolled recursion. The attack may be initiated remotely. The patch is named 627b5b1b2fc2. It is suggested to install a patch to address this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:ND/RL:OF/RC:C"}}], "timeline": [{"time": "2026-09-30T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-09-30T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-09-30T08:02:10.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "zzxzzb (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/411874", "name": "VDB-411874 | GraphicsMagick WPG File wpg.c ExtractPostscript recursion", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/411874/cti", "name": "VDB-411874 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-103118", "name": "CVE-2026-103118 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/954970", "name": "Submit #954970 | Graphicsmagick 1.3.47 and prior; fixed in development changeset 627b5b1b2fc2 (2026-08-24), not yet in any release Uncontrolled Recursion", "tags": ["third-party-advisory"]}, {"url": "https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/627b5b1b2fc2", "tags": ["patch"]}], "tags": ["x_open-source"], "x_generator": ["VulDB PVTS v202609"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-02T16:13:06.398536Z", "id": "CVE-2026-103118", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-02T16:13:17.749Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-103118", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-02T16:13:06.398536Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-02T16:13:12.999Z"}}], "cna": {"tags": ["x_open-source"], "title": "GraphicsMagick WPG File wpg.c ExtractPostscript recursion", "credits": [{"lang": "en", "type": "reporter", "value": "zzxzzb (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:ND/RL:OF/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:graphicsmagick:graphicsmagick:*:*:*:*:*:*:*:*"], "vendor": "n/a", "modules": ["WPG File Handler"], "product": "GraphicsMagick", "versions": [{"status": "affected", "version": "1.3.0"}, {"status": "affected", "version": "1.3.1"}, {"status": "affected", "version": "1.3.2"}, {"status": "affected", "version": "1.3.3"}, {"status": "affected", "version": "1.3.4"}, {"status": "affected", "version": "1.3.5"}, {"status": "affected", "version": "1.3.6"}, {"status": "affected", "version": "1.3.7"}, {"status": "affected", "version": "1.3.8"}, {"status": "affected", "version": "1.3.9"}, {"status": "affected", "version": "1.3.10"}, {"status": "affected", "version": "1.3.11"}, {"status": "affected", "version": "1.3.12"}, {"status": "affected", "version": "1.3.13"}, {"status": "affected", "version": "1.3.14"}, {"status": "affected", "version": "1.3.15"}, {"status": "affected", "version": "1.3.16"}, {"status": "affected", "version": "1.3.17"}, {"status": "affected", "version": "1.3.18"}, {"status": "affected", "version": "1.3.19"}, {"status": "affected", "version": "1.3.20"}, {"status": "affected", "version": "1.3.21"}, {"status": "affected", "version": "1.3.22"}, {"status": "affected", "version": "1.3.23"}, {"status": "affected", "version": "1.3.24"}, {"status": "affected", "version": "1.3.25"}, {"status": "affected", "version": "1.3.26"}, {"status": "affected", "version": "1.3.27"}, {"status": "affected", "version": "1.3.28"}, {"status": "affected", "version": "1.3.29"}, {"status": "affected", "version": "1.3.30"}, {"status": "affected", "version": "1.3.31"}, {"status": "affected", "version": "1.3.32"}, {"status": "affected", "version": "1.3.33"}, {"status": "affected", "version": "1.3.34"}, {"status": "affected", "version": "1.3.35"}, {"status": "affected", "version": "1.3.36"}, {"status": "affected", "version": "1.3.37"}, {"status": "affected", "version": "1.3.38"}, {"status": "affected", "version": "1.3.39"}, {"status": "affected", "version": "1.3.40"}, {"status": "affected", "version": "1.3.41"}, {"status": "affected", "version": "1.3.42"}, {"status": "affected", "version": "1.3.43"}, {"status": "affected", "version": "1.3.44"}, {"status": "affected", "version": "1.3.45"}, {"status": "affected", "version": "1.3.46"}, {"status": "affected", "version": "1.3.47"}]}], "timeline": [{"lang": "en", "time": "2026-09-30T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-09-30T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-09-30T08:02:10.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/411874", "name": "VDB-411874 | GraphicsMagick WPG File wpg.c ExtractPostscript recursion", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/411874/cti", "name": "VDB-411874 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-103118", "name": "CVE-2026-103118 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/954970", "name": "Submit #954970 | Graphicsmagick 1.3.47 and prior; fixed in development changeset 627b5b1b2fc2 (2026-08-24), not yet in any release Uncontrolled Recursion", "tags": ["third-party-advisory"]}, {"url": "https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/627b5b1b2fc2", "tags": ["patch"]}], "x_generator": ["VulDB PVTS v202609"], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in GraphicsMagick up to 1.3.47. Affected by this vulnerability is the function ExtractPostscript of the file coders/wpg.c of the component WPG File Handler. Performing a manipulation results in uncontrolled recursion. The attack may be initiated remotely. The patch is named 627b5b1b2fc2. It is suggested to install a patch to address this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-674", "description": "Uncontrolled Recursion"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-404", "description": "Denial of Service"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-09-30T13:30:05.945Z"}}}, "cveMetadata": {"cveId": "CVE-2026-103118", "state": "PUBLISHED", "dateUpdated": "2026-10-02T16:13:17.749Z", "dateReserved": "2026-09-30T05:57:03.831Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-09-30T13:30:05.945Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:graphicsmagick:graphicsmagick:*:*:*:*:*:*:*:*"], "modules": ["WPG File Handler"], "product": "GraphicsMagick", "vendor": "n/a", "versions": [{"status": "affected", "version": "1.3.0"}, {"status": "affected", "version": "1.3.1"}, {"status": "affected", "version": "1.3.2"}, {"status": "affected", "version": "1.3.3"}, {"status": "affected", "version": "1.3.4"}, {"status": "affected", "version": "1.3.5"}, {"status": "affected", "version": "1.3.6"}, {"status": "affected", "version": "1.3.7"}, {"status": "affected", "version": "1.3.8"}, {"status": "affected", "version": "1.3.9"}, {"status": "affected", "version": "1.3.10"}, {"status": "affected", "version": "1.3.11"}, {"status": "affected", "version": "1.3.12"}, {"status": "affected", "version": "1.3.13"}, {"status": "affected", "version": "1.3.14"}, {"status": "affected", "version": "1.3.15"}, {"status": "affected", "version": "1.3.16"}, {"status": "affected", "version": "1.3.17"}, {"status": "affected", "version": "1.3.18"}, {"status": "affected", "version": "1.3.19"}, {"status": "affected", "version": "1.3.20"}, {"status": "affected", "version": "1.3.21"}, {"status": "affected", "version": "1.3.22"}, {"status": "affected", "version": "1.3.23"}, {"status": "affected", "version": "1.3.24"}, {"status": "affected", "version": "1.3.25"}, {"status": "affected", "version": "1.3.26"}, {"status": "affected", "version": "1.3.27"}, {"status": "affected", "version": "1.3.28"}, {"status": "affected", "version": "1.3.29"}, {"status": "affected", "version": "1.3.30"}, {"status": "affected", "version": "1.3.31"}, {"status": "affected", "version": "1.3.32"}, {"status": "affected", "version": "1.3.33"}, {"status": "affected", "version": "1.3.34"}, {"status": "affected", "version": "1.3.35"}, {"status": "affected", "version": "1.3.36"}, {"status": "affected", "version": "1.3.37"}, {"status": "affected", "version": "1.3.38"}, {"status": "affected", "version": "1.3.39"}, {"status": "affected", "version": "1.3.40"}, {"status": "affected", "version": "1.3.41"}, {"status": "affected", "version": "1.3.42"}, {"status": "affected", "version": "1.3.43"}, {"status": "affected", "version": "1.3.44"}, {"status": "affected", "version": "1.3.45"}, {"status": "affected", "version": "1.3.46"}, {"status": "affected", "version": "1.3.47"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in GraphicsMagick up to 1.3.47. Affected by this vulnerability is the function ExtractPostscript of the file coders/wpg.c of the component WPG File Handler. Performing a manipulation results in uncontrolled recursion. The attack may be initiated remotely. The patch is named 627b5b1b2fc2. It is suggested to install a patch to address this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product."}], "id": "CVE-2026-103118", "lastModified": "2026-10-02T17:17:01.630", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-103118", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-02T16:13:06.398536Z", "version": "2.0.3"}}]}, "published": "2026-09-30T14:17:27.347", "references": [{"source": "cna@vuldb.com", "url": "https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/627b5b1b2fc2"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-103118"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/954970"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/411874"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/411874/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-404"}, {"lang": "en", "value": "CWE-674"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{"bugzilla": {"description": "GraphicsMagick: GraphicsMagick: Denial of Service via uncontrolled recursion in WPG file handler", "id": "2543931", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543931"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-835", "details": ["A flaw was found in GraphicsMagick. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by convincing a user or service to process a specially crafted WordPerfect Graphics (WPG) image file. Due to uncontrolled recursion within the WPG file handler's ExtractPostscript function, parsing the malicious input leads to stack exhaustion and crashes the application."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-103118", "public_date": "2026-09-30T13:30:05Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-103118\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-103118\nhttps://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/627b5b1b2fc2\nhttps://vuldb.com/cve/CVE-2026-103118\nhttps://vuldb.com/submit/954970\nhttps://vuldb.com/vuln/411874\nhttps://vuldb.com/vuln/411874/cti"], "statement": "GraphicsMagick is not shipped in any Red Hat product. It is only available in Fedora and EPEL community repositories.", "threat_severity": "Moderate"}