The AcquireCacheNexus function in magick/pixel_cache.c in GraphicsMagick before 1.3.28 can allow an attacker to cause a denial of service (heap overwrite) or possibly have unspecified other impact via a crafted image file, because a pixel staging area is not used.
Created GraphicsMagick tracking bugs for this issue:
Affects: epel-all [bug 1543273]
Affects: fedora-all [bug 1543274]
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):