CVE-2026-103118 - Vulnerability Details

- GraphicsMagick WPG File wpg.c ExtractPostscript recursion

Description

A vulnerability was detected in GraphicsMagick up to 1.3.47. Affected by this vulnerability is the function ExtractPostscript of the file coders/wpg.c of the component WPG File Handler. Performing a manipulation results in uncontrolled recursion. The attack may be initiated remotely. The patch is named 627b5b1b2fc2. It is suggested to install a patch to address this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Published: 2026-09-30

Score: 5.3 Medium

EPSS: < 1% Very Low

KEV: No

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

n/a

GraphicsMagick

affected

Version	Status	Constraints
`1.3.0`	affected	—
`1.3.1`	affected	—
`1.3.2`	affected	—
`1.3.3`	affected	—
`1.3.4`	affected	—
`1.3.5`	affected	—
`1.3.6`	affected	—
`1.3.7`	affected	—
`1.3.8`	affected	—
`1.3.9`	affected	—
`1.3.10`	affected	—
`1.3.11`	affected	—
`1.3.12`	affected	—
`1.3.13`	affected	—
`1.3.14`	affected	—
`1.3.15`	affected	—
`1.3.16`	affected	—
`1.3.17`	affected	—
`1.3.18`	affected	—
`1.3.19`	affected	—
`1.3.20`	affected	—
`1.3.21`	affected	—
`1.3.22`	affected	—
`1.3.23`	affected	—
`1.3.24`	affected	—
`1.3.25`	affected	—
`1.3.26`	affected	—
`1.3.27`	affected	—
`1.3.28`	affected	—
`1.3.29`	affected	—
`1.3.30`	affected	—
`1.3.31`	affected	—
`1.3.32`	affected	—
`1.3.33`	affected	—
`1.3.34`	affected	—
`1.3.35`	affected	—
`1.3.36`	affected	—
`1.3.37`	affected	—
`1.3.38`	affected	—
`1.3.39`	affected	—
`1.3.40`	affected	—
`1.3.41`	affected	—
`1.3.42`	affected	—
`1.3.43`	affected	—
`1.3.44`	affected	—
`1.3.45`	affected	—
`1.3.46`	affected	—
`1.3.47`	affected	—

No data.

Vendor Product Confidence Versions

Graphicsmagick

95%

Version	Status	Scheme	Platform
`1.3.0`	affected	semver	—
`1.3.1`	affected	semver	—
`1.3.2`	affected	semver	—
`1.3.3`	affected	semver	—
`1.3.4`	affected	semver	—
`1.3.5`	affected	semver	—
`1.3.6`	affected	semver	—
`1.3.7`	affected	semver	—
`1.3.8`	affected	semver	—
`1.3.9`	affected	semver	—
`1.3.10`	affected	semver	—
`1.3.11`	affected	semver	—
`1.3.12`	affected	semver	—
`1.3.13`	affected	semver	—
`1.3.14`	affected	semver	—
`1.3.15`	affected	semver	—
`1.3.16`	affected	semver	—
`1.3.17`	affected	semver	—
`1.3.18`	affected	semver	—
`1.3.19`	affected	semver	—
`1.3.20`	affected	semver	—
`1.3.21`	affected	semver	—
`1.3.22`	affected	semver	—
`1.3.23`	affected	semver	—
`1.3.24`	affected	semver	—
`1.3.25`	affected	semver	—
`1.3.26`	affected	semver	—
`1.3.27`	affected	semver	—
`1.3.28`	affected	semver	—
`1.3.29`	affected	semver	—
`1.3.30`	affected	semver	—
`1.3.31`	affected	semver	—
`1.3.32`	affected	semver	—
`1.3.33`	affected	semver	—
`1.3.34`	affected	semver	—
`1.3.35`	affected	semver	—
`1.3.36`	affected	semver	—
`1.3.37`	affected	semver	—
`1.3.38`	affected	semver	—
`1.3.39`	affected	semver	—
`1.3.40`	affected	semver	—
`1.3.41`	affected	semver	—
`1.3.42`	affected	semver	—
`1.3.43`	affected	semver	—
`1.3.44`	affected	semver	—
`1.3.45`	affected	semver	—
`1.3.46`	affected	semver	—
`1.3.47`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction Required

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction Required

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00293.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/627b5b1b2fc2
https://nvd.nist.gov/vuln/detail/CVE-2026-103118
https://vuldb.com/cve/CVE-2026-103118
https://vuldb.com/submit/954970
https://vuldb.com/vuln/411874
https://vuldb.com/vuln/411874/cti
https://www.cve.org/CVERecord?id=CVE-2026-103118

History

Fri, 02 Oct 2026 17:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 01 Oct 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-835
References		https://nvd.nist.gov/vuln/detail/CVE-2026-103118 https://www.cve.org/CVERecord?id=CVE-2026-103118
Metrics	threat_severity `None`	threat_severity `Moderate`

Wed, 30 Sep 2026 13:45:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability was detected in GraphicsMagick up to 1.3.47. Affected by this vulnerability is the function ExtractPostscript of the file coders/wpg.c of the component WPG File Handler. Performing a manipulation results in uncontrolled recursion. The attack may be initiated remotely. The patch is named 627b5b1b2fc2. It is suggested to install a patch to address this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Title		GraphicsMagick WPG File wpg.c ExtractPostscript recursion
First Time appeared		Graphicsmagick Graphicsmagick graphicsmagick
Weaknesses		CWE-404 CWE-674
CPEs		cpe:2.3:a:graphicsmagick:graphicsmagick::::::::
Vendors & Products		Graphicsmagick Graphicsmagick graphicsmagick
References		https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/627b5b1b2fc2 https://vuldb.com/cve/CVE-2026-103118 https://vuldb.com/submit/954970 https://vuldb.com/vuln/411874 https://vuldb.com/vuln/411874/cti
Metrics		cvssV2_0 `{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:N/I:N/A:P/E:ND/RL:OF/RC:C'}` cvssV3_0 `{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C'}` cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C'}` cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X'}`

Subscriptions

Graphicsmagick Graphicsmagick

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-09-30T13:30:05.945Z

Updated: 2026-10-02T16:13:17.749Z

Reserved: 2026-09-30T05:57:03.831Z

Link: CVE-2026-103118

Vulnrichment

Updated: 2026-10-02T16:13:12.999Z

NVD

Status : Awaiting Analysis

Published: 2026-09-30T14:17:27.347

Modified: 2026-10-02T17:17:01.630

Link: CVE-2026-103118

Redhat

Severity : Moderate

Publid Date: 2026-09-30T13:30:05Z

Links: CVE-2026-103118 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-01T03:45:17Z

Weaknesses

CWE-404
Improper Resource Shutdown or Release
CWE-674
Uncontrolled Recursion
CWE-835
Loop with Unreachable Exit Condition ('Infinite Loop')

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction Required

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction Required

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object