{"id":"CVE-2026-13606","aliases":["DEBIAN-CVE-2026-13606","OESA-2026-3132","SUSE-SU-2026:2820-1","UBUNTU-CVE-2026-13606","openSUSE-SU-2026:11245-1","openSUSE-SU-2026:21282-1"],"status":"published","title":"GraphicsMagick security update","description":"GraphicsMagick is a comprehensive image processing package which is initially based on ImageMagick 5.5.2, but which has undergone significant re-work by the GraphicsMagick Group to significantly improve the quality and performance of the software.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in GraphicsMagick\u0026apos;s Photo CD (PCD) decoder. A remote attacker could exploit this vulnerability by providing a specially crafted PCD file. This could lead to an out-of-bounds write, corrupting memory and potentially causing a denial of service or other unpredictable system behavior.(CVE-2026-13606)","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","from":"osv"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-06-30T00:00:00Z","modified":"2026-10-17T12:58:46Z","fixes":[{"ecosystem":"Debian:14","package":"graphicsmagick","fixed_in":["1.4+really1.3.48-1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"GraphicsMagick","fixed_in":["1.3.41-4.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"GraphicsMagick","fixed_in":["1.3.41-4.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"GraphicsMagick","fixed_in":["1.3.41-4.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"GraphicsMagick","fixed_in":["1.3.41-4.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"GraphicsMagick","fixed_in":["1.3.47-2.oe2403sp4"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"GraphicsMagick","fixed_in":["1.3.42-150600.3.33.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"GraphicsMagick","fixed_in":["1.3.47-4.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"GraphicsMagick","fixed_in":["1.3.45-160000.9.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4+really1.3.40-4","1.4+really1.3.40-4+deb12u1","1.4+really1.3.41-1","1.4+really1.3.42-1","1.4+really1.3.42-1.1","1.4+really1.3.42-1.1~exp1","1.4+really1.3.43-1","1.4+really1.3.44-1","1.4+really1.3.45+hg17689-1","1.4+really1.3.45+hg17692-1","1.4+really1.3.45+hg17696-1","1.4+really1.3.45-1","1.4+really1.3.46-1","1.4+really1.3.46-2","1.4+really1.3.48-1"]},{"source":"osv","ecosystem":"Debian:13","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4+really1.3.45+hg17696-1","1.4+really1.3.46-1","1.4+really1.3.46-2","1.4+really1.3.48-1"]},{"source":"osv","ecosystem":"Debian:14","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4+really1.3.48-1"}]}],"versions":["1.4+really1.3.45+hg17696-1","1.4+really1.3.46-1","1.4+really1.3.46-2"]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"GraphicsMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.41-4.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"GraphicsMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.41-4.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"GraphicsMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.41-4.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"GraphicsMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.41-4.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"GraphicsMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.47-2.oe2403sp4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"GraphicsMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.42-150600.3.33.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.16-1.1ubuntu2","1.3.16-1.1ubuntu3","1.3.18-1ubuntu3","1.3.18-1ubuntu3.1","1.3.18-1ubuntu3.1+esm1","1.3.18-1ubuntu3.1+esm2","1.3.18-1ubuntu3.1+esm3","1.3.18-1ubuntu3.1+esm4","1.3.18-1ubuntu3.1+esm5","1.3.18-1ubuntu3.1+esm6","1.3.18-1ubuntu3.1+esm7","1.3.18-1ubuntu3.1+esm8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.21-3","1.3.23-1","1.3.23-1build1","1.3.23-1ubuntu0.1","1.3.23-1ubuntu0.1+esm1","1.3.23-1ubuntu0.2","1.3.23-1ubuntu0.3","1.3.23-1ubuntu0.4","1.3.23-1ubuntu0.5","1.3.23-1ubuntu0.6","1.3.23-1ubuntu0.6+esm1","1.3.23-1ubuntu0.6+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.26-15","1.3.26-16","1.3.26-19","1.3.27-1","1.3.27-2","1.3.27-3","1.3.28-1","1.3.28-2","1.3.28-2ubuntu0.1","1.3.28-2ubuntu0.1+esm1","1.3.28-2ubuntu0.2","1.3.28-2ubuntu0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4+really1.3.33+hg16115-1","1.4+really1.3.33+hg16115-1build1","1.4+really1.3.33+hg16117-1","1.4+really1.3.34-1","1.4+really1.3.34-2","1.4+really1.3.34+hg16181-1","1.4+really1.3.35-1","1.4+really1.3.35-1ubuntu0.1~esm1","1.4+really1.3.35-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4+really1.3.36+hg16481-2","1.4+really1.3.37-1","1.4+really1.3.37-1build1","1.4+really1.3.37+hg16662-1ubuntu1","1.4+really1.3.38-1","1.4+really1.3.38-1ubuntu0.1","1.4+really1.3.38-1ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4+really1.3.42-1","1.4+really1.3.42-1build1","1.4+really1.3.42-1.1build1","1.4+really1.3.42-1.1build2","1.4+really1.3.42-1.1build3","1.4+really1.3.42-1.1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4+really1.3.45+hg17689-1","1.4+really1.3.45+hg17696-1","1.4+really1.3.45+hg17696-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4+really1.3.46-2","1.4+really1.3.48-1","1.4+really1.3.48-1build1","1.4+really1.3.48-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4+really1.3.45+hg17696-1build1","1.4+really1.3.46-2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"GraphicsMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.47-4.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"GraphicsMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.45-160000.9.1"}]}]}],"references":[{"url":"https://security-tracker.debian.org/tracker/CVE-2026-13606","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3132","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13606","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262820-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1269891","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-13606","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-13606","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-13606","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2494107","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"osv":[{"id":"OESA-2026-3132","title":"GraphicsMagick security update","description":"GraphicsMagick is a comprehensive image processing package which is initially based on ImageMagick 5.5.2, but which has undergone significant re-work by the GraphicsMagick Group to significantly improve the quality and performance of the software.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in GraphicsMagick\u0026apos;s Photo CD (PCD) decoder. A remote attacker could exploit this vulnerability by providing a specially crafted PCD file. This could lead to an out-of-bounds write, corrupting memory and potentially causing a denial of service or other unpredictable system behavior.(CVE-2026-13606)","status":"published","published":"2026-07-24T11:12:00Z","modified":"2026-08-18T01:21:23.967494479Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"DEBIAN-CVE-2026-13606","status":"published","published":"2026-06-30T09:48:13.542252354Z","modified":"2026-09-01T15:05:58.983165779Z","updated_at":"2026-11-02T15:45:51.374409Z"},{"id":"openSUSE-SU-2026:11245-1","title":"GraphicsMagick-1.3.47-4.1 on GA media","description":"These are all security issues fixed in the GraphicsMagick-1.3.47-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-10T00:00:00Z","modified":"2026-07-11T09:15:07.27012134Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21282-1","title":"Security update for GraphicsMagick","description":"This update for GraphicsMagick fixes the following issue\n\n- CVE-2026-13606: crafted Photo CD (PCD) file can cause memory corruption (bsc#1269891).\n","status":"published","published":"2026-07-10T08:53:04Z","modified":"2026-07-13T18:24:55.648331236Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:2820-1","title":"Security update for GraphicsMagick","description":"This update for GraphicsMagick fixes the following issue\n\n- CVE-2026-13606: crafted Photo CD (PCD) file can cause memory corruption (bsc#1269891).\n","status":"published","published":"2026-07-09T18:01:14Z","modified":"2026-07-10T10:00:06.105423553Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"UBUNTU-CVE-2026-13606","description":"[Unknown description]","status":"published","published":"2026-06-30T00:00:00Z","modified":"2026-10-17T12:58:46.229513911Z","updated_at":"2026-11-02T16:56:00.592716Z"}]}}