{"id":"CVE-2025-32460","aliases":["DEBIAN-CVE-2025-32460","DSA-5905-1","EUVD-2025-10418","GHSA-hf7q-qx98-4hm7","JLSEC-2026-495","MGASA-2025-0148","OESA-2025-1506","ROOT-OS-ALPINE-322-CVE-2025-32460","ROOT-OS-ALPINE-324-CVE-2025-32460","SUSE-SU-2025:1349-1","UBUNTU-CVE-2025-32460","openSUSE-SU-2025:14993-1"],"status":"published","title":"GraphicsMagick before 8e56520 has a heap-based buffer over-read in ReadJXLImage in coders/jxl.c,...","description":"GraphicsMagick before 8e56520 has a heap-based buffer over-read in ReadJXLImage in coders/jxl.c, related to an ImportViewPixelArea call.","severity":{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00367,"percentile":0.30799,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2025-04-09T00:00:00Z","modified":"2026-10-17T12:57:27Z","fixes":[{"ecosystem":"Debian:12","package":"graphicsmagick","fixed_in":["1.4+really1.3.40-4+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"graphicsmagick","fixed_in":["1.4+really1.3.45+hg17696-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"graphicsmagick","fixed_in":["1.4+really1.3.45+hg17696-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"GraphicsMagick_jll","fixed_in":["1.3.47+0"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"graphicsmagick","fixed_in":["1.3.40-1.2.mga9","1.3.40-1.2.mga9.tainted"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.22","package":"graphicsmagick","fixed_in":["1.3.45-r00071","1.3.45-r00072","1.3.45-r00073","1.3.45-r00074","1.3.45-r00075"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.22","package":"rootio-graphicsmagick","fixed_in":["1.3.45-r00071","1.3.45-r00072","1.3.45-r00073","1.3.45-r00074","1.3.45-r00075"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.24","package":"graphicsmagick","fixed_in":["1.3.47-r00071"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.24","package":"rootio-graphicsmagick","fixed_in":["1.3.47-r00071"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"GraphicsMagick","fixed_in":["1.3.42-150600.3.7.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"GraphicsMagick","fixed_in":["1.3.42-150600.3.7.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"GraphicsMagick","fixed_in":["1.3.45-3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4+really1.3.40-4+deb12u1"}]}],"versions":["1.4+really1.3.40-4"]},{"source":"osv","ecosystem":"Debian:13","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4+really1.3.45+hg17696-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4+really1.3.45+hg17696-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4+really1.3.40-4+deb12u1"}]}],"versions":["1.4+really1.3.40-4"],"bundled":2},{"source":"osv","ecosystem":"Julia","package":"GraphicsMagick_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.3.47+0"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.40-1.2.mga9"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.40-1.2.mga9.tainted"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"GraphicsMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.41-2.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"GraphicsMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.41-2.oe2203sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"GraphicsMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.41-2.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"GraphicsMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.41-2.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"GraphicsMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.41-2.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"Root:Alpine:3.22","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.45-r00071"},{"fixed":"1.3.45-r00072"},{"fixed":"1.3.45-r00073"},{"fixed":"1.3.45-r00074"},{"fixed":"1.3.45-r00075"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.22","package":"rootio-graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.45-r00071"},{"fixed":"1.3.45-r00072"},{"fixed":"1.3.45-r00073"},{"fixed":"1.3.45-r00074"},{"fixed":"1.3.45-r00075"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.24","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.47-r00071"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.24","package":"rootio-graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.47-r00071"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"GraphicsMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.42-150600.3.7.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"GraphicsMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.42-150600.3.7.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.16-1.1ubuntu2","1.3.16-1.1ubuntu3","1.3.18-1ubuntu3","1.3.18-1ubuntu3.1","1.3.18-1ubuntu3.1+esm1","1.3.18-1ubuntu3.1+esm2","1.3.18-1ubuntu3.1+esm3","1.3.18-1ubuntu3.1+esm4","1.3.18-1ubuntu3.1+esm5","1.3.18-1ubuntu3.1+esm6","1.3.18-1ubuntu3.1+esm7","1.3.18-1ubuntu3.1+esm8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.21-3","1.3.23-1","1.3.23-1build1","1.3.23-1ubuntu0.1","1.3.23-1ubuntu0.1+esm1","1.3.23-1ubuntu0.2","1.3.23-1ubuntu0.3","1.3.23-1ubuntu0.4","1.3.23-1ubuntu0.5","1.3.23-1ubuntu0.6","1.3.23-1ubuntu0.6+esm1","1.3.23-1ubuntu0.6+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.26-15","1.3.26-16","1.3.26-19","1.3.27-1","1.3.27-2","1.3.27-3","1.3.28-1","1.3.28-2","1.3.28-2ubuntu0.1","1.3.28-2ubuntu0.1+esm1","1.3.28-2ubuntu0.2","1.3.28-2ubuntu0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4+really1.3.33+hg16115-1","1.4+really1.3.33+hg16115-1build1","1.4+really1.3.33+hg16117-1","1.4+really1.3.34-1","1.4+really1.3.34-2","1.4+really1.3.34+hg16181-1","1.4+really1.3.35-1","1.4+really1.3.35-1ubuntu0.1~esm1","1.4+really1.3.35-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4+really1.3.36+hg16481-2","1.4+really1.3.37-1","1.4+really1.3.37-1build1","1.4+really1.3.37+hg16662-1ubuntu1","1.4+really1.3.38-1","1.4+really1.3.38-1ubuntu0.1","1.4+really1.3.38-1ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4+really1.3.42-1","1.4+really1.3.42-1build1","1.4+really1.3.42-1.1build1","1.4+really1.3.42-1.1build2","1.4+really1.3.42-1.1build3","1.4+really1.3.42-1.1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4+really1.3.45+hg17689-1","1.4+really1.3.45+hg17696-1","1.4+really1.3.45+hg17696-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4+really1.3.46-2","1.4+really1.3.48-1","1.4+really1.3.48-1build1","1.4+really1.3.48-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4+really1.3.45+hg17696-1build1","1.4+really1.3.46-2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"GraphicsMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.45-3.1"}]}]}],"products":[{"vendor":"graphicsmagick","product":"graphicsmagick"}],"references":[{"url":"https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/8e56520435df50f618a03f2721a39a70a515f1cb","tags":["Patch","fix","web","report"]},{"url":"https://tracker.debian.org/news/1636753/accepted-graphicsmagick-14really1345hg17696-1-source-into-unstable/","tags":["Mailing List","article","web","report"]},{"url":"https://issues.oss-fuzz.com/issues/406320404","tags":["Exploit","Issue Tracking","Patch","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32460","tags":["web","advisory"]},{"url":"https://tracker.debian.org/news/1636753/accepted-graphicsmagick-14really1345hg17696-1-source-into-unstable","tags":["web"]},{"url":"https://github.com/advisories/GHSA-hf7q-qx98-4hm7","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-32460","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0148.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34218","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/6QYCKFE7IU3HOGGUF42EURRWALAXSG4Z/","tags":["web"]},{"url":"https://lists.debian.org/debian-security-announce/2025/msg00067.html","tags":["web"]},{"url":"https://lists.suse.com/pipermail/sle-updates/2025-April/039065.html","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1506","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27795","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20251349-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1241150","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-32460","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-32460","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-32460","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/6QYCKFE7IU3HOGGUF42EURRWALAXSG4Z/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-32460","description":"GraphicsMagick before 8e56520 has a heap-based buffer over-read in ReadJXLImage in coders/jxl.c, related to an ImportViewPixelArea call.","status":"published","published":"2025-04-09T00:00:00Z","modified":"2025-04-09T19:27:10.698Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:32:46.42892Z"}],"euvd":[{"id":"EUVD-2025-10418","description":"GraphicsMagick before 8e56520 has a heap-based buffer over-read in ReadJXLImage in coders/jxl.c, related to an ImportViewPixelArea call.","status":"published","published":"2025-04-09T00:00:00Z","modified":"2025-04-09T19:27:10Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:52:37.733624Z"}],"ghsa":[{"id":"GHSA-hf7q-qx98-4hm7","title":"GraphicsMagick before 8e56520 has a heap-based buffer over-read in ReadJXLImage in coders/jxl.c,...","description":"GraphicsMagick before 8e56520 has a heap-based buffer over-read in ReadJXLImage in coders/jxl.c, related to an ImportViewPixelArea call.","status":"published","published":"2025-04-09T04:18:20Z","modified":"2025-04-09T04:18:30Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:01:01.61975Z"}],"nvd":[{"id":"CVE-2025-32460","description":"GraphicsMagick before 8e56520 has a heap-based buffer over-read in ReadJXLImage in coders/jxl.c, related to an ImportViewPixelArea call.","status":"published","published":"2025-04-09T02:15:15.137Z","modified":"2026-06-17T09:12:01.78Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:11:00.087098Z"}],"osv":[{"id":"CVE-2025-32460","description":"GraphicsMagick before 8e56520 has a heap-based buffer over-read in ReadJXLImage in coders/jxl.c, related to an ImportViewPixelArea call.","status":"published","published":"2025-04-09T02:15:15.137Z","modified":"2026-04-16T04:30:29.717713579Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:48.02508Z"},{"id":"DEBIAN-CVE-2025-32460","description":"GraphicsMagick before 8e56520 has a heap-based buffer over-read in ReadJXLImage in coders/jxl.c, related to an ImportViewPixelArea call.","status":"published","published":"2025-04-09T02:15:15.137Z","modified":"2026-09-01T20:05:46.002672753Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:45.870237Z"},{"id":"JLSEC-2026-495","title":"GraphicsMagick before 8e56520 has a heap-based buffer over-read in ReadJXLImage in `coders/jxl.c`,...","description":"GraphicsMagick before 8e56520 has a heap-based buffer over-read in ReadJXLImage in `coders/jxl.c`, related to an ImportViewPixelArea call.","status":"published","published":"2026-05-13T01:42:44.063Z","modified":"2026-07-25T18:24:31.579675652Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"OESA-2025-1506","title":"GraphicsMagick security update","description":"GraphicsMagick is a comprehensive image processing package which is initially based on ImageMagick 5.5.2, but which has undergone significant re-work by the GraphicsMagick Group to significantly improve the quality and performance of the software.\r\n\r\nSecurity Fix(es):\n\nReadJXLImage in JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.(CVE-2025-27795)\n\nGraphicsMagick before 8e56520 has a heap-based buffer over-read in ReadJXLImage in coders/jxl.c, related to an ImportViewPixelArea call.(CVE-2025-32460)","status":"published","published":"2025-05-09T11:08:36Z","modified":"2026-08-18T01:17:57.822596784Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"UBUNTU-CVE-2025-32460","description":"GraphicsMagick before 8e56520 has a heap-based buffer over-read in ReadJXLImage in coders/jxl.c, related to an ImportViewPixelArea call.","status":"published","published":"2025-04-09T02:15:00Z","modified":"2026-10-17T12:57:27.835334011Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T16:55:28.829873Z"},{"id":"DSA-5905-1","title":"graphicsmagick - security update","status":"published","published":"2025-04-17T00:00:00Z","modified":"2026-03-09T02:11:29.166219Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"MGASA-2025-0148","title":"Updated graphicsmagick packages fix security vulnerabilities","description":"GraphicsMagick before 8e56520 has a heap-based buffer over-read in\nReadJXLImage in coders/jxl.c, related to an ImportViewPixelArea call.\n(CVE-2025-32460)\n","status":"published","published":"2025-05-05T04:57:03Z","modified":"2026-04-16T04:40:37.989542453Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2025:14993-1","title":"GraphicsMagick-1.3.45-3.1 on GA media","description":"These are all security issues fixed in the GraphicsMagick-1.3.45-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-04-15T00:00:00Z","modified":"2026-02-04T04:03:51.531495Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"ROOT-OS-ALPINE-322-CVE-2025-32460","title":"CVE-2025-32460 in graphicsmagick - Patched by Root","description":"Root has patched CVE-2025-32460 in the graphicsmagick package for Root:Alpine:3.22. Multiple fixed versions available.","status":"published","published":"2026-09-29T09:19:40Z","modified":"2026-09-29T10:15:41.902430682Z","updated_at":"2026-11-02T15:53:28.544053Z"},{"id":"ROOT-OS-ALPINE-324-CVE-2025-32460","title":"CVE-2025-32460 in graphicsmagick - Patched by Root","description":"Root has patched CVE-2025-32460 in the graphicsmagick package for Root:Alpine:3.24. Multiple fixed versions available.","status":"published","published":"2026-10-01T08:49:44Z","modified":"2026-10-01T09:15:04.278285643Z","updated_at":"2026-11-02T15:53:28.544053Z"},{"id":"SUSE-SU-2025:1349-1","title":"Security update for GraphicsMagick","description":"This update for GraphicsMagick fixes the following issues:\n\n- CVE-2025-32460: Fixed a heap-based buffer over-read in ReadJXLImage. (bsc#1241150)\n","status":"published","published":"2025-04-18T10:06:16Z","modified":"2026-02-04T02:28:31.095084Z","updated_at":"2026-11-02T15:53:59.381172Z"}]}}