ANT-2026-VTJ2W5KM · graphicsmagick/graphicsmagick

heap-buffer-overflow high

Severity Claude critical · Security research firm high · Maintainer -

Discovered by Claude Mythos Preview

REPORT

Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics.

ANT-2026-VTJ2W5KM: Heap-buffer-overflow in pcx.c:1186

A 1034-byte crafted MIFF image, when converted to PCX format with GraphicsMagick, deterministically triggers a heap-buffer-overflow in WritePCXImage (coders/pcx.c:1186). An 880-byte buffer allocated via _MagickReallocateResourceLimitedMemoryLoc at pcx.c:1179 is written one byte past its end. The crash reproduced identically across 3 runs in a fresh container, reached via the standard convert command path (ConvertImageCommand -> WriteImages -> WriteImage -> WritePCXImage). This is a genuine, reproducible memory-safety bug in the PCX output coder.

Target

Project: graphicsmagick
Location: pcx.c:1186

Technical Details

ASAN: heap-buffer-overflow WRITE of size 1, 0 bytes to the right of an 880-byte region. The buffer is allocated at coders/pcx.c:1179 via _MagickReallocateResourceLimitedMemoryLoc, and the write at pcx.c:1186 overruns it by exactly one byte — the allocation size computation under-counts the bytes the writer will emit for this input.

Crash trace:

The PoC (1034-byte MIFF image) triggers a deterministic heap-buffer-overflow (WRITE) in GraphicsMagick's PCX writer when converting to PCX format. All 3 runs in a fresh container crashed identically:

- Error: AddressSanitizer: heap-buffer-overflow on WRITE of size 1
- Location: `WritePCXImage` at `coders/pcx.c:1186`
- Root cause: An 880-byte heap buffer (allocated via `_MagickReallocateResourceLimitedMemoryLoc` at `coders/pcx.c:1179`) is written 1 byte past its end (0 bytes to the right of the 880-byte region)
- Exit code: 1 (all 3 runs)
- Full call chain through project code: `WritePCXImage` -> `WriteImage` -> `WriteImages` -> `ConvertImageCommand` -> `MagickCommand` -> `GMCommandSingle` -> `GMCommand` -> `main`

This is a genuine, reproducible memory safety vulnerability in GraphicsMagick's PCX output coder.

Reproduction

  1. Craft a ~1KB MIFF image that exercises the vulnerable sizing path in the PCX writer
  2. Cause the target to run gm convert poc.miff out.pcx (or equivalent API call)
  3. WritePCXImage writes 1 byte past the 880-byte heap buffer at pcx.c:1186

[No reproducer or sanitizer output attached — request from security-cvd@anthropic.com if needed.]

Acknowledgement

This vulnerability was discovered by Claude, Anthropic's AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research. Please direct questions to security-cvd@anthropic.com and reference ANT-2026-VTJ2W5KM.

Reference: ANT-2026-VTJ2W5KM
Anthropic CVD Policy: https://www.anthropic.com/coordinated-vulnerability-disclosure

SECURITY RESEARCH FIRM ANALYSIS

Triage and disclosure were performed by Ada Logics.

Verdict
true positive
Severity
high
TIMELINE

Dates from discovery through public reveal.

  1. 2026-03-24 Reported to tracker
  2. 2026-05-30 Patch released
  3. 2026-05-31 Sent to maintainer
  4. 2026-08-18 Publicly revealed
PROVENANCE

SHA-3-512 hash:

afbc0b83b9a368c629db36e2a0569437545406a68003921577e5e367eb5cf341d59d9e62c28f5c43e1bfa8db3d60f3bad8ea9ee77f8b81fa44a28df4183f1dd3

Committed 2026-05-31 00:18 PT

Revealed 2026-08-18 03:03 PT

Verify (download preimage.json)

Show preimage JSON 
{
  "ant_id": "ANT-2026-VTJ2W5KM",
  "bug_class": "Heap-buffer-overflow",
  "claude_severity": "critical",
  "commit_sha": null,
  "created_at": "2026-03-24T18:45:40+00:00",
  "description": "A 1034-byte crafted MIFF image, when converted to PCX format with GraphicsMagick, deterministically triggers a heap-buffer-overflow in WritePCXImage (coders/pcx.c:1186). An 880-byte buffer allocated via _MagickReallocateResourceLimitedMemoryLoc at pcx.c:1179 is written one byte past its end. The crash reproduced identically across 3 runs in a fresh container, reached via the standard convert command path (ConvertImageCommand -> WriteImages -> WriteImage -> WritePCXImage). This is a genuine, reproducible memory-safety bug in the PCX output coder.",
  "discovered_at": null,
  "location": "pcx.c:1186",
  "poc_sha256": null,
  "preimage_version": 1,
  "project": "graphicsmagick",
  "reproduction": [
    "1. Craft a ~1KB MIFF image that exercises the vulnerable sizing path in the PCX writer",
    "2. Cause the target to run `gm convert poc.miff out.pcx` (or equivalent API call)",
    "3. WritePCXImage writes 1 byte past the 880-byte heap buffer at pcx.c:1186"
  ],
  "technical_details": "ASAN: heap-buffer-overflow WRITE of size 1, 0 bytes to the right of an 880-byte region. The buffer is allocated at coders/pcx.c:1179 via _MagickReallocateResourceLimitedMemoryLoc, and the write at pcx.c:1186 overruns it by exactly one byte — the allocation size computation under-counts the bytes the writer will emit for this input.",
  "title": "Heap-buffer-overflow in pcx.c:1186",
  "vendor_severity": "high"
}