ALAS2023-2026-1960

References: CVE-2026-13606  CVE-2026-77118 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

A flaw was found in GraphicsMagick's Photo CD (PCD) decoder. A remote attacker could exploit this vulnerability by providing a specially crafted PCD file. This could lead to an out-of-bounds write, corrupting memory and potentially causing a denial of service or other unpredictable system behavior. (CVE-2026-13606)

A heap out-of-bounds write exists in the Photo CD (PCD) decoder of GraphicsMagick. In DecodeImage() (coders/pcd.c), the Huffman delta loop advances its output pointer with q++ after every decoded delta and never checks it against the end of the heap-allocated luma/chroma plane buffers. The pointer is repositioned only when a sync marker introduces a new plane/row; between sync markers the run length is bounded solely by the input.

A crafted PCD file that positions the pointer near the end of a plane and then supplies a long run of deltas with no intervening sync therefore walks the pointer past the end of the allocation and writes through it. Processing an untrusted PCD file -- for example with gm convert or gm identify, or through any application linked against libGraphicsMagick -- can corrupt heap memory beyond the buffers. (CVE-2026-77118)

Issue Correction:
Run dnf update GraphicsMagick --releasever 2023.12.20260720 or dnf update --advisory ALAS2023-2026-1960 --releasever 2023.12.20260720 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:

aarch64:
    GraphicsMagick-c++-devel-1.3.45-1.amzn2023.0.3.aarch64
    GraphicsMagick-c++-debuginfo-1.3.45-1.amzn2023.0.3.aarch64
    GraphicsMagick-debugsource-1.3.45-1.amzn2023.0.3.aarch64
    GraphicsMagick-devel-1.3.45-1.amzn2023.0.3.aarch64
    GraphicsMagick-perl-debuginfo-1.3.45-1.amzn2023.0.3.aarch64
    GraphicsMagick-c++-1.3.45-1.amzn2023.0.3.aarch64
    GraphicsMagick-perl-1.3.45-1.amzn2023.0.3.aarch64
    GraphicsMagick-1.3.45-1.amzn2023.0.3.aarch64
    GraphicsMagick-debuginfo-1.3.45-1.amzn2023.0.3.aarch64

noarch:
    GraphicsMagick-doc-1.3.45-1.amzn2023.0.3.noarch

src:
    GraphicsMagick-1.3.45-1.amzn2023.0.3.src

x86_64:
    GraphicsMagick-c++-debuginfo-1.3.45-1.amzn2023.0.3.x86_64
    GraphicsMagick-c++-devel-1.3.45-1.amzn2023.0.3.x86_64
    GraphicsMagick-debugsource-1.3.45-1.amzn2023.0.3.x86_64
    GraphicsMagick-perl-debuginfo-1.3.45-1.amzn2023.0.3.x86_64
    GraphicsMagick-devel-1.3.45-1.amzn2023.0.3.x86_64
    GraphicsMagick-perl-1.3.45-1.amzn2023.0.3.x86_64
    GraphicsMagick-c++-1.3.45-1.amzn2023.0.3.x86_64
    GraphicsMagick-1.3.45-1.amzn2023.0.3.x86_64
    GraphicsMagick-debuginfo-1.3.45-1.amzn2023.0.3.x86_64