CVE-2026-13606

GraphicsMagick security update

7.8 HighFix available

GraphicsMagick is a comprehensive image processing package which is initially based on ImageMagick 5.5.2, but which has undergone significant re-work by the GraphicsMagick Group to significantly improve the quality and performance of the software.

Security Fix(es):

A flaw was found in GraphicsMagick's Photo CD (PCD) decoder. A remote attacker could exploit this vulnerability by providing a specially crafted PCD file. This could lead to an out-of-bounds write, corrupting memory and potentially causing a denial of service or other unpredictable system behavior.(CVE-2026-13606)

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

What each source reports

OSV Score usedOESA-2026-3132 7.8

GraphicsMagick security update

Security Fix(es):

Record: OESA-2026-3132
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVopenSUSE-SU-2026:11245-1 No score

GraphicsMagick-1.3.47-4.1 on GA media

These are all security issues fixed in the GraphicsMagick-1.3.47-4.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:11245-1
Updated: 2026-11-02

OSVopenSUSE-SU-2026:21282-1 No score

Security update for GraphicsMagick

This update for GraphicsMagick fixes the following issue

CVE-2026-13606: crafted Photo CD (PCD) file can cause memory corruption (bsc#1269891).

Record: openSUSE-SU-2026:21282-1
Updated: 2026-11-02

OSVSUSE-SU-2026:2820-1 No score

Security update for GraphicsMagick

This update for GraphicsMagick fixes the following issue

CVE-2026-13606: crafted Photo CD (PCD) file can cause memory corruption (bsc#1269891).

Record: SUSE-SU-2026:2820-1
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-13606 No score

[Unknown description]

Record: UBUNTU-CVE-2026-13606
Updated: 2026-11-02

Affected packages

Affected packages
Package	Affected	Fixed
`graphicsmagick` Debian:12	All versions, plus listed versions 1.4+really1.3.40-41.4+really1.3.40-4+deb12u11.4+really1.3.41-11.4+really1.3.42-11.4+really1.3.42-1.1 Show 10 moreShow less 1.4+really1.3.42-1.1~exp11.4+really1.3.43-11.4+really1.3.44-11.4+really1.3.45+hg17689-11.4+really1.3.45+hg17692-11.4+really1.3.45+hg17696-11.4+really1.3.45-11.4+really1.3.46-11.4+really1.3.46-21.4+really1.3.48-1	None known
`graphicsmagick` Debian:13	All versions, plus listed versions 1.4+really1.3.45+hg17696-11.4+really1.3.46-11.4+really1.3.46-21.4+really1.3.48-1	None known
`graphicsmagick` Debian:14	before 1.4+really1.3.48-1, plus listed versions 1.4+really1.3.45+hg17696-11.4+really1.3.46-11.4+really1.3.46-2	1.4+really1.3.48-1
`GraphicsMagick` openEuler:20.03-LTS-SP4	before 1.3.41-4.oe2003sp4	1.3.41-4.oe2003sp4
`GraphicsMagick` openEuler:22.03-LTS-SP4	before 1.3.41-4.oe2203sp4	1.3.41-4.oe2203sp4
`GraphicsMagick` openEuler:24.03-LTS-SP1	before 1.3.41-4.oe2403sp1	1.3.41-4.oe2403sp1
`GraphicsMagick` openEuler:24.03-LTS-SP3	before 1.3.41-4.oe2403sp3	1.3.41-4.oe2403sp3
`GraphicsMagick` openEuler:24.03-LTS-SP4	before 1.3.47-2.oe2403sp4	1.3.47-2.oe2403sp4
`GraphicsMagick` SUSE:Linux Enterprise Module for Package Hub 15 SP7	before 1.3.42-150600.3.33.1	1.3.42-150600.3.33.1
`graphicsmagick` Ubuntu:Pro:14.04:LTS	All versions, plus listed versions 1.3.16-1.1ubuntu21.3.16-1.1ubuntu31.3.18-1ubuntu31.3.18-1ubuntu3.11.3.18-1ubuntu3.1+esm1 Show 7 moreShow less 1.3.18-1ubuntu3.1+esm21.3.18-1ubuntu3.1+esm31.3.18-1ubuntu3.1+esm41.3.18-1ubuntu3.1+esm51.3.18-1ubuntu3.1+esm61.3.18-1ubuntu3.1+esm71.3.18-1ubuntu3.1+esm8	None known

Show 10 moreShow less

Affected packages
Package	Affected	Fixed
`graphicsmagick` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 1.3.21-31.3.23-11.3.23-1build11.3.23-1ubuntu0.11.3.23-1ubuntu0.1+esm1 Show 7 moreShow less 1.3.23-1ubuntu0.21.3.23-1ubuntu0.31.3.23-1ubuntu0.41.3.23-1ubuntu0.51.3.23-1ubuntu0.61.3.23-1ubuntu0.6+esm11.3.23-1ubuntu0.6+esm2	None known
`graphicsmagick` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 1.3.26-151.3.26-161.3.26-191.3.27-11.3.27-2 Show 7 moreShow less 1.3.27-31.3.28-11.3.28-21.3.28-2ubuntu0.11.3.28-2ubuntu0.1+esm11.3.28-2ubuntu0.21.3.28-2ubuntu0.2+esm1	None known
`graphicsmagick` Ubuntu:Pro:20.04:LTS	All versions, plus listed versions 1.4+really1.3.33+hg16115-11.4+really1.3.33+hg16115-1build11.4+really1.3.33+hg16117-11.4+really1.3.34-11.4+really1.3.34-2 Show 4 moreShow less 1.4+really1.3.34+hg16181-11.4+really1.3.35-11.4+really1.3.35-1ubuntu0.1~esm11.4+really1.3.35-1ubuntu0.1	None known
`graphicsmagick` Ubuntu:Pro:22.04:LTS	All versions, plus listed versions 1.4+really1.3.36+hg16481-21.4+really1.3.37-11.4+really1.3.37-1build11.4+really1.3.37+hg16662-1ubuntu11.4+really1.3.38-11.4+really1.3.38-1ubuntu0.11.4+really1.3.38-1ubuntu0.1+esm1	None known
`graphicsmagick` Ubuntu:Pro:24.04:LTS	All versions, plus listed versions 1.4+really1.3.42-11.4+really1.3.42-1build11.4+really1.3.42-1.1build11.4+really1.3.42-1.1build21.4+really1.3.42-1.1build31.4+really1.3.42-1.1ubuntu0.1~esm1	None known
`graphicsmagick` Ubuntu:25.10	All versions, plus listed versions 1.4+really1.3.45+hg17689-11.4+really1.3.45+hg17696-11.4+really1.3.45+hg17696-1build1	None known
`graphicsmagick` Ubuntu:26.10	All versions, plus listed versions 1.4+really1.3.46-21.4+really1.3.48-11.4+really1.3.48-1build11.4+really1.3.48-2	None known
`graphicsmagick` Ubuntu:26.04:LTS	All versions, plus listed versions 1.4+really1.3.45+hg17696-1build11.4+really1.3.46-2	None known
`GraphicsMagick` openSUSE:Tumbleweed	before 1.3.47-4.1	1.3.47-4.1
`GraphicsMagick` openSUSE:Leap 16.0	before 1.3.45-160000.9.1	1.3.45-160000.9.1

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-13606 is a high vulnerability (CVSS 7.8) in graphicsmagick, published June 30, 2026. No source lists public exploit code. Fixed in graphicsmagick 1.4+really1.3.48-1.