Technical impact
The vulnerability resides in the ExtractPostscript function within the GraphicsMagick WPG file handler. When a crafted WPG file is processed, the function can enter an uncontrolled recursion loop, potentially exhausting stack memory or causing a crash. This deficiency can be leveraged by a remote attacker to cause a denial‑of‑service condition on the affected system. The weak points correspond to CWE‑404, CWE‑674, and CWE‑835, reflecting improper input handling and lack of recursion limits.
Affected Systems
GraphicsMagick versions up to and including 1.3.47 are affected. The issue appears in the wpg.c component of the WPG file handler. Systems that use older GraphicsMagick releases and accept untrusted WPG files should consider the risk. A patch (commit 627b5b1b2fc2) has been released to fix the recursion problem.
Risk and Exploitability
The CVSS score of 5.3 indicates a medium severity. EPSS information is not available, and the vulnerability is not yet listed in the CISA KEV catalog. Although the attack vector is reported as remote, the exact conditions—for example, required privileges or network exposure—are not detailed, so if a system processes WPG files from an external source, the risk remains. Due to the medium score and lack of exploit data, the likelihood of exploitation appears low but should not be dismissed, especially in environments where WPG files are routinely handled.
