CVE-2019-11005: Graphicsmagick

Critical severity, CVSS 9.8. EPSS: 3.5% chance of exploitation in the next 30 days.

In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a stack-based buffer overflow in the function SVGStartElement of coders/svg.c, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a quoted font family value.

Affected products

• Graphicsmagick Graphicsmagick: up to and including 1.3.31
• Opensuse Leap: version 15.0 only; version 42.3 only

Published 2019-04-08. Last modified 2026-06-17.