Every CVE Search/ Get API key

CVE-2025-27795

JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.

4.3 MediumFix available

ReadJXLImage in JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.45%Up 0.4 points since Mar 8, 2025
90%50%10%1%

What each source reports

CVE List Score used 4.3

ReadJXLImage in JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.

Record
CVE-2025-27795
CVSS 3.1
4.3 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
Weakness
CWE-770
Updated
2026-11-02
EUVDEUVD-2025-6240 4.3

ReadJXLImage in JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.

Record
EUVD-2025-6240
CVSS 3.1
4.3 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-69r2-5wxm-3hf6 4.3

JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.

JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.

Record
GHSA-69r2-5wxm-3hf6
CVSS 3.1
4.3 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
Weakness
CWE-770
Updated
2026-11-02
NVD 4.3

ReadJXLImage in JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.

Record
CVE-2025-27795
CVSS 3.1
4.3 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-770
Updated
2026-11-02
OSV 7.5

ReadJXLImage in JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.

Record
CVE-2025-27795
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2025-27795 7.5

ReadJXLImage in JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.

Record
DEBIAN-CVE-2025-27795
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 9 moreShow less
OSVJLSEC-2026-493 7.5

JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.

ReadJXLImage in JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.

Record
JLSEC-2026-493
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2025-1506 4.3

GraphicsMagick security update

GraphicsMagick is a comprehensive image processing package which is initially based on ImageMagick 5.5.2, but which has undergone significant re-work by the GraphicsMagick Group to significantly improve the quality and performance of the software.

Security Fix(es):

ReadJXLImage in JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.(CVE-2025-27795)

GraphicsMagick before 8e56520 has a heap-based buffer over-read in ReadJXLImage in coders/jxl.c, related to an ImportViewPixelArea call.(CVE-2025-32460)

Record
OESA-2025-1506
CVSS 3.1
4.3 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2025-27795 4.3

ReadJXLImage in JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.

Record
UBUNTU-CVE-2025-27795
CVSS 3.1
4.3 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2025-27796 4.5

ReadWPGImage in WPG in GraphicsMagick before 1.3.46 mishandles palette buffer allocation, resulting in out-of-bounds access to heap memory in ReadBlob.

Record
UBUNTU-CVE-2025-27796
CVSS 3.1
4.5 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L
Updated
2026-11-02
OSVMGASA-2025-0132 No score

Updated graphicsmagick packages fix security vulnerabilities

ReadJXLImage in JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits. (CVE-2025-27795)

Record
MGASA-2025-0132
Updated
2026-11-02
OSVopenSUSE-SU-2025:14949-1 No score

GraphicsMagick-1.3.45-2.1 on GA media

These are all security issues fixed in the GraphicsMagick-1.3.45-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:14949-1
Updated
2026-11-02
OSVROOT-OS-ALPINE-322-CVE-2025-27795 No score

CVE-2025-27795 in graphicsmagick - Patched by Root

Root has patched CVE-2025-27795 in the graphicsmagick package for Root:Alpine:3.22. Multiple fixed versions available.

Record
ROOT-OS-ALPINE-322-CVE-2025-27795
Updated
2026-11-02
OSVSUSE-SU-2025:1129-1 No score

Security update for GraphicsMagick

This update for GraphicsMagick fixes the following issues:

  • CVE-2025-27795: Fixed missing image dimension resource limits in JXL (bsc#1239044)
Record
SUSE-SU-2025:1129-1
Updated
2026-11-02
OSVUSN-7433-1 No score

graphicsmagick vulnerabilities

It was discovered that GraphicsMagick did not properly limit image dimensions, which could lead to excessive memory consumption. An attacker could possibly use this issue to cause a denial of service. (CVE-2025-27795)

It was discovered that GraphicsMagick did not properly handle certain memory operations, which could lead to a out-of-bounds memory access. An attacker could possibly use this issue to leak sensitive information. This issue only affected Ubuntu 24.10. (CVE-2025-27796)

Record
USN-7433-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
graphicsmagick
Debian:12
 before 1.4+really1.3.40-4+deb12u1, plus listed versions
1.4+really1.3.40-4
1.4+really1.3.40-4+deb12u1
graphicsmagick
Debian:13
 before 1.4+really1.3.45+hg17689-1
1.4+really1.3.45+hg17689-1
graphicsmagick
Debian:14
 before 1.4+really1.3.45+hg17689-1
1.4+really1.3.45+hg17689-1
graphicsmagick
Debian:12
From an advisory covering 2 CVEs
 before 1.4+really1.3.40-4+deb12u1, plus listed versions
1.4+really1.3.40-4
1.4+really1.3.40-4+deb12u1
GraphicsMagick_jll
Julia
 before 1.3.47+0
1.3.47+0
graphicsmagick
Mageia:9
 before 1.3.40-1.1.mga9
1.3.40-1.1.mga9
graphicsmagick
Mageia:9
 before 1.3.40-1.1.mga9.tainted
1.3.40-1.1.mga9.tainted
GraphicsMagick
openEuler:20.03-LTS-SP4
From an advisory covering 2 CVEs
 before 1.3.41-2.oe2003sp4
1.3.41-2.oe2003sp4
GraphicsMagick
openEuler:22.03-LTS-SP3
From an advisory covering 2 CVEs
 before 1.3.41-2.oe2203sp3
1.3.41-2.oe2203sp3
GraphicsMagick
openEuler:22.03-LTS-SP4
From an advisory covering 2 CVEs
 before 1.3.41-2.oe2203sp4
1.3.41-2.oe2203sp4
Show 9 moreShow less
Affected packages
PackageAffectedFixed
GraphicsMagick
openEuler:24.03-LTS
From an advisory covering 2 CVEs
 before 1.3.41-2.oe2403sp1
1.3.41-2.oe2403sp1
GraphicsMagick
openEuler:24.03-LTS-SP1
From an advisory covering 2 CVEs
 before 1.3.41-2.oe2403sp1
1.3.41-2.oe2403sp1
graphicsmagick
Root:Alpine:3.22
 before 1.3.45-r00072
1.3.45-r000721.3.45-r000731.3.45-r000741.3.45-r00075
rootio-graphicsmagick
Root:Alpine:3.22
 before 1.3.45-r00072
1.3.45-r000721.3.45-r000731.3.45-r000741.3.45-r00075
GraphicsMagick
SUSE:Linux Enterprise Module for Package Hub 15 SP6
 before 1.3.42-150600.3.4.1
1.3.42-150600.3.4.1
GraphicsMagick
openSUSE:Leap 15.6
 before 1.3.42-150600.3.4.1
1.3.42-150600.3.4.1
graphicsmagick
Ubuntu:Pro:22.04:LTS
 before 1.4+really1.3.38-1ubuntu0.1+esm1, plus listed versions
1.4+really1.3.36+hg16481-21.4+really1.3.37-11.4+really1.3.37-1build11.4+really1.3.37+hg16662-1ubuntu11.4+really1.3.38-11.4+really1.3.38-1ubuntu0.1
1.4+really1.3.38-1ubuntu0.1+esm1
graphicsmagick
Ubuntu:Pro:24.04:LTS
 before 1.4+really1.3.42-1.1ubuntu0.1~esm1, plus listed versions
1.4+really1.3.42-11.4+really1.3.42-1build11.4+really1.3.42-1.1build11.4+really1.3.42-1.1build21.4+really1.3.42-1.1build3
1.4+really1.3.42-1.1ubuntu0.1~esm1
GraphicsMagick
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 1.3.45-2.1
1.3.45-2.1

History

History
RecordedChangedSources
affected, facts
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-27795 is a medium vulnerability (CVSS 4.3) in Graphicsmagick, published March 7, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.45%, the 39th percentile. Fixed in graphicsmagick 1.4+really1.3.40-4+deb12u1.

References

Show 19 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open