I am the GraphicsMagick developer/maintainer and am concerned that
Debian may not have addressed ImageMagick CVE-2026-56379 in Debian
'trixie' and 'bookworm' as applies to GraphicsMagick prior to the 1.3.49
release.

As a reminder, CVE-2026-56379 is regarding the SVG reader and is about a
command injection vulnerability which allows attackers to execute
arbitrary code via crafted SVG files containing malicious drawing
commands. This is a serious bug inherited from ImageMagick!

The security hazards emanating from this are only limited by the
imagination.

Bob

Hi Bob,
 Please note that prior the 1.3.49 release is a bit wide. I try to
investigate the commit that introduced this vulnerability. I can't
find a proper Hg repository at the moment. What I can reach at the
moment has just about a hundred commits from the past.
 Am I right, the fix is this commit [1] noted as "coders/svg.c:
Address ImageMagick CVE-2026-56379"? This seems to address the wrong
strchr(value,'\'') checks with strpbrk(value,"'\n\r") ones.
Please note that Debian Trixie has GM Hg commit 17696 from March 31th,
2025. While the introductory commit seems to be this one [2], which is
from May 8th, 2026.
That is, I think Trixie is not affected by this vulnerability if we
see only the code and what is changed. May you have a reproducer?
Maybe both mentioned commits should be backported to the SVG image
handler?

Thanks,
Laszlo/GCS
[1] https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/d70680f531c745c6b15cda843cd3f40427c6f99f
[2] https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/86c5191ee41c19c7e051a2469d15bc14ac22e73f

This vulnerability is not new.  It was inherited from ImageMagick since
GraphicsMagick started in 2002.  As far as I am aware, it was not fixed
in ImageMagick until recently.  I was informed of the issue (which had
just been fixed in ImageMagick 7) by Petr Gajdos of Suse Linux on July
28, 2026.  Perhaps the issue still exists in ImageMagick for Trixie.

BTFW, this issue is coming to my attention because of a (possibly)
remote triggered user/system exploit (leveraging something else) which
is greatly eased by this SVG bug.

A convenient place to look at GraphicsMagick code is at
https://foss.heptapod.net/graphicsmagick/graphicsmagick.
https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/d70680f531c745c6b15cda843cd3f40427c6f99f

I will attach the two SVG files I was provided.

Bob

I took a look at the commit [2] that you mention, and it did not cause
the problem.  The problem was caused by already (long) existing prints
for which the quoting can easily be broken out of (falsely terminated)
in order to inject more commands.

 That means, really fixing this is only possible with a full package
update to the 1.3.49 version? As I read you, backporting some commits
is not enough to fix this vulnerability. But a full update to the SVG
reader is required (at least recommended).

Regards,
Laszlo/GCS

It seems possible to produce a patch just for the SVG issue, but of
course if one reads the NEWS file, there are many other security issues
addressed by 1.3.49.

Keep in mind that although GraphicsMagick claims to be ABI (as pertains
to the shared library APIs) upward compatible, someone did already
complain about their program being impacted by a behavior change (image
pointer is end of list upon appending an image rather than the front of
the list) since the dawn of time.

Bob

 Question remains, how someone can determine which patches the SVG
reader needs to fix this issue. I think a full release update would be
preferable.
 Indeed, that's why I packaged Hg revisions for a while instead of
full releases. Nowadays I use full releases again - I'm not sure how
(if) you test GM after each commit. Do you try to make all (most of
those at least) Hg revisions safe for the end user?
Now if I use the new Hg web browser interface [1], clicking on
'History' and then 'Next' at the bottom ends the commit log
immediately. Is it me who uses it incorrectly?

Regards,
Laszlo/GCS
[1] https://foss.heptapod.net/graphicsmagick/graphicsmagick

normal case), then the GraphicsMagick test suite is executed (via 'make
check') successfully before pushing any changes.  If the latest
ChangeLog entry says "NEWS.txt: Update the news." then the release news
has been updated.

The shared library SO versions are only updated at the time of the release.

GraphicsMagick Mercurial is also at SourceForge if you are able to
access it.  Or you can clone the repository and use an Hg viewer (e.g.
TortoiseHg 'thg' if it still works for you) or run 'hg serve' and a web
browser locally.

Bob