Hi,

The following vulnerability was published for graphicsmagick.

The information available is only from RedHat bugzilla at time of this
writing, might you reach out to upstream to see if they are ware of
it?

CVE-2026-13606[0]:
| Memory corruption via crafted Photo CD (PCD) file

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-13606
https://www.cve.org/CVERecord?id=CVE-2026-13606
[1] https://bugzilla.redhat.com/show_bug.cgi?id=2494107

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

I am not sure what CVE-2026-13606 is specifically about. However, there
are two recent GraphicsMagick security fixes for coders/pcd.c:

         * coders/pcd.c (ReadPCDImage): Over-provision the per-channel
         Huffman decode buffers and detect any attempt to overflow
         them. Fixes are inspired by fixes in ImageMagick, but retaining
         the original planar design. Discovered and reported by Cipher -
         Causal Security (https://causalsecurity.com/) via email on June
         14, 2026.

        * coders/pcd.c (DecodeImage): Correct loop initialization to
         prevent out of bounds read. Similar to ImageMagick commit 5204a16
         which addresses ImageMagick security advisory GHSA-wrhr-rf8j-r842.
         Much thanks to Petr Gajdos for bringing this to my attention.

They correspond to these Mercurial changesets:

    changeset:   18093:937cdd9920bd
    user:        Bob Friesenhahn <bfriesen@GraphicsMagick.org>
    date:        Wed Jun 24 09:08:14 2026 -0500
    files:       ChangeLog NEWS.txt
    VisualMagick/installer/inc/version.isx coders/pcd.c magick/version.h
    www/ChangeLog.html www/NEWS.html
    description:
    coders/pcd.c (ReadPCDImage): Over-provision the per-channel Huffman
    decode buffers and detect any attempt to overflow them.

    changeset:   18036:44292e321682
    user:        Bob Friesenhahn <bfriesen@GraphicsMagick.org>
    date:        Sun Apr 12 08:50:03 2026 -0500
    files:       ChangeLog coders/pcd.c www/ChangeLog.html
    description:
    coders/pcd.c (DecodeImage): Correct loop initialization to prevent
    out of bounds read (ImageMagick security advisory GHSA-wrhr-rf8j-r842)

It is a shame that so much effort is needed for an extinct format that
hardly anyone uses any more.

Bob

Hi Bob,
[...]
 I heard, but not investigated myself, that some entities release CVE
ids without enough information about what the correct fix is. :(
My question is, is there any possibility that the mentioned 'library
symbol remapping' multiple times has a chance to break other libraries
or binaries? It seems the following library symbols are now missing in
the 1.3.48 release: DCM_SetRescaling@Base, GetColorInfo@Base,
GetColorInfoArray@Base, InsertRowHDU@Base, MagickReallocStd@Base,
WriteBlobStringEOL@Base and WriteBlobStringWithEOL@Base.
I know that most library symbols are used by GM itself, just want to be sure.

Thanks,
Laszlo/GCS

László,

Thanks for noticing this!  As you surmised, these symbols were all
intended for internal use. The only one which could have been used by an
external consumer is MagickReallocStd().  However, the behavior of
MagickRealloc() (also intended for internal use) has since been modified
to behave like standard realloc() and so MagickReallocStd() was removed.

This is my analysis:

DCM_SetRescaling

   Private to coders/dcm.c. DLL-exported by accident (default).

GetColorInfo
GetColorInfoArray

   Declared in color_lookup-private.h. Used only by color_lookup.c
   implementation. Exported by accident (default).

InsertRowHDU

   Private to coders/fits.c. DLL-exported by accident (default).

MagickReallocStd

   Intended for internal use, but it is theoretically usable by an
   external consumer.

   Added on 2023-11-05 by changeset 17283. First released in
   1.3.43. Visibility removed on 2025-12-16 by changeset 17856. This
   function was added for internal use. Also on 2025-12-16, in changeset
17857
   MagickReallocStd() was removed and the behavior of MagickRealloc()
   was changed to match standard ANSI C realloc().

WriteBlobStringEOL
WriteBlobStringWithEOL

   Private to locale.c. DLL-exported by accident.

Bob

We believe that the bug you reported is fixed in the latest version of
graphicsmagick, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1141493@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Laszlo Boszormenyi (GCS) <gcs@debian.org> (supplier of updated graphicsmagick package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sun, 26 Jul 2026 10:07:19 +0200
Source: graphicsmagick
Architecture: source
Version: 1.4+really1.3.48-1
Distribution: unstable
Urgency: high
Maintainer: Laszlo Boszormenyi (GCS) <gcs@debian.org>
Changed-By: Laszlo Boszormenyi (GCS) <gcs@debian.org>
Closes: 1141493
Changes:
 graphicsmagick (1.4+really1.3.48-1) unstable; urgency=high
 .
   * New upstream release:
     - fixes CVE-2026-13606: memory corruption via crafted Photo CD (PCD) file
       (closes: #1141493).
   * Update library symbols for this release.
Checksums-Sha1:
 4c518c6e57198fb76e5c7763a528a61b3f825f9d 3026 graphicsmagick_1.4+really1.3.48-1.dsc
 cd71364d1736838811f399326b998d6653630b5f 6081828 graphicsmagick_1.4+really1.3.48.orig.tar.xz
 dbc42d7a4aff3ef86d9b7a660e2a985b0686ca99 228 graphicsmagick_1.4+really1.3.48.orig.tar.xz.asc
 4ad1b71b82a3563945df87d4de7782f7eedd54a9 156876 graphicsmagick_1.4+really1.3.48-1.debian.tar.xz
Checksums-Sha256:
 541f3adbb1a8c98aca3e203afaf7b69d0da3d486cba15b08cf8c9fb0024f9114 3026 graphicsmagick_1.4+really1.3.48-1.dsc
 9218eb78179110f91371066ab75cb3b4dd034b9bb464b29ce9bab7a11979232b 6081828 graphicsmagick_1.4+really1.3.48.orig.tar.xz
 5608f09614f126e34101421a310d8fed310dd6502bbb4efdc987384b097ae8d9 228 graphicsmagick_1.4+really1.3.48.orig.tar.xz.asc
 201a5b6eb98a2dc4d7c2ce5c4460bef910f296d8330c7bf826aeca8f34873be9 156876 graphicsmagick_1.4+really1.3.48-1.debian.tar.xz
Files:
 cf463772856d30f4b820b0baf96b5ca1 3026 graphics optional graphicsmagick_1.4+really1.3.48-1.dsc
 3ac3fee835156179cea2f78ffc2dcdbe 6081828 graphics optional graphicsmagick_1.4+really1.3.48.orig.tar.xz
 cef397b4f80cd0a6caa2a59124742880 228 graphics optional graphicsmagick_1.4+really1.3.48.orig.tar.xz.asc
 7b52cb083451663e62fe7f15f7ee8bc7 156876 graphics optional graphicsmagick_1.4+really1.3.48-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEfYh9yLp7u6e4NeO63OMQ54ZMyL8FAmpmK/oACgkQ3OMQ54ZM
yL/MEw//d3rF3TBlvIx9nTQ4ngtDAO9NP2zIRJ7KnqM4QH9yM4+NQsyeujW10ST7
CpqJcBhjADAPQOHKVM8vnBi4rH4v5borgrWfNrvCiJ/ydguIgF8LzxucrzQMlYhv
eAwkhQKUUPgEIxrSkTYUrMI9rkuEV9LOq2kCWHLLHag4+zIo9nu5UHy3PPLxG0m0
Awr6numYRT8MZVIv18sN5iO5+C58Y/uP4dT4KYtCl6BNFWQ0b5Z/pzfvZS0nHcEf
pbzpUcw0uqutn5+7EgA7W3+Ja7e9xtF6DOMPaaoAqgL3b3ysIZKsjmksfjEJSZKD
S26td8VabJFuCeFs7+7GBf86AdWnfYUdWV8MrxxSJcuLZps9HtN4EpXEzU47fuYo
NQxnapRC3Uh8BnAqCD9+GVVlknm5q7EDe7087zivWHDO7itYEy14kU4vhZbHcN4F
spumqwHXBM/ffe71IlN+nzw2DWu9hVV3oLA1R4pSNmWa/DDQ3Y2vYdIGVQfTs79y
FCzn5XQjsQp+jIkZ3H+yIVd6Q6krgLreIn5nBgECya2/rdTdUdYshTAbp9FipIhf
LATAl6+NFkpbY6PXJjiJttarQzYQfslTCkHZ6BnGQmv8TfRQS9heWqQ39+WiVNzF
IitA/5avVtgo6RQ/JO4FF/4F7yaxhnyVvAMvnP8gcKLwESleWKQ=
=OJyU
-----END PGP SIGNATURE-----