A flaw exists in GraphicsMagick’s Photo CD (PCD) decoder that permits a specially crafted PCD file to trigger an out‑of‑bounds write. This memory corruption can overwrite adjacent data structures, causing the application to crash, become unresponsive, or experience unpredictable behavior. The weakness is a classic example of CWE‑787: Out‑of‑Bounds Write.

The vulnerability affects installations of GraphicsMagick that use the default PCD decoder. Specific product version information is not disclosed in the available data, so any deployment that has not applied a fix from the vendor is potentially vulnerable.

The CVSS score of 8.1 indicates high severity. EPSS information is not available, so the current likelihood of exploitation cannot be quantified but the lack of a mitigation suggests that a motivated attacker could feasibly craft a malicious PCD file. The description explicitly states that a remote attacker could exploit the flaw, implying that the attack vector may involve remote file ingestion, such as through a web service or network share that processes PCD images. Because the vulnerability is listed as not being part of the CISA KEV catalog, there is no evidence of widespread exploitation at this time. Nonetheless, the nature of the flaw—out‑of‑bounds write—warrants cautious handling and remediation.