CVE-2012-3438: The Magick_png_malloc function in coders/png.c in GraphicsMagick 6.7.8-6 does not use the proper variable t...

Security readout for executives and security teams

This issue affects GraphicsMagick PNG handling. A specially crafted PNG can make the program allocate memory incorrectly and crash. For organizations that process user-supplied images, the business risk is service disruption rather than confirmed data theft or code execution. Most relevant where GraphicsMagick processes PNG uploads, email or media attachments, batch image pipelines, CMS assets, or API-submitted images. Exposure is lower where PNG inputs are trusted or GraphicsMagick is absent. The bundle does not provide complete affected-version ranges beyond 6.7.8-6. Handle as a service-availability risk for systems that process outside images. It is not supported by the bundle as critical or actively exploited, but exposed upload pipelines should be updated through vendor-supported packages on normal security timelines. Mitigation focus: Inventory systems and containers that include GraphicsMagick, especially image-processing services.; Check vendor advisories for fixed or backported package versions before changing production.; Prioritize updates on internet-facing or user-upload image pipelines..

Prepared

Jun 27, 2026, 17:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.