CVE-2018-20185: Canonical Ubuntu Linux

Medium severity, CVSS 5.3. EPSS: 2.1% chance of exploitation in the next 30 days.

In GraphicsMagick 1.4 snapshot-20181209 Q8 on 32-bit platforms, there is a heap-based buffer over-read in the ReadBMPImage function of bmp.c, which allows attackers to cause a denial of service via a crafted bmp image file. This only affects GraphicsMagick installations with customized BMP limits.

Affected products

• Canonical Ubuntu Linux: version 18.04 only
• Debian Debian Linux: version 8.0 only; version 9.0 only; version 10.0 only
• Graphicsmagick Graphicsmagick: version 1.4 only

Published 2018-12-17. Last modified 2026-06-17.