CVE-2026-103118 GraphicsMagick WPG File wpg.c ExtractPostscript recursion
Remote attackers can cause a denial of service via uncontrolled recursion in the WPG file handler of GraphicsMagick.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-103118?
CVE-2026-103118 is a medium-severity denial of service vulnerability in GraphicsMagick, published on 30 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability was detected in GraphicsMagick up to 1.3.47. Affected by this vulnerability is the function ExtractPostscript of the file coders/wpg.c of the component WPG File Handler. Performing a manipulation results in uncontrolled recursion. The attack may be initiated remotely. The patch is named 627b5b1b2fc2. It is suggested to install a patch to address this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Which versions are affected by CVE-2026-103118?
Linux distribution packages (2)
GraphicsMagick SUSE:Linux Enterprise Module for Package Hub 15 SP7 | All versions | 1.3.42-150600.3.48.1 |
GraphicsMagick openSUSE:Tumbleweed | All versions | 1.3.48-3.1 |
How do I fix CVE-2026-103118?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-103118 being exploited?
There is no known exploitation of CVE-2026-103118 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-103118, ECHO-062b-0761-fc27, GHSA-4c5c-7x65-ccwp, SUSE-SU-2026:4592-1, UBUNTU-CVE-2026-103118, openSUSE-SU-2026:12089-1.