CVE-2025-32460 — Out-of-bounds Read in Graphicsmagick

CWE-125 — Out-of-bounds Read5 documents5 sources
Severity
9.1CRITICALNVD
CNA4.0
EPSS
0.3%
top 47.55%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Graphicsmagick
Timeline
PublishedApr 9

Description

GraphicsMagick before 8e56520 has a heap-based buffer over-read in ReadJXLImage in coders/jxl.c, related to an ImportViewPixelArea call.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:HExploitability: 3.9 | Impact: 5.2

Affected Packages3 packages

▶CVEListV5graphicsmagick/graphicsmagick< 8e56520435df50f618a03f2721a39a70a515f1cb
▶Debiangraphicsmagick/graphicsmagick< 1.4+really1.3.40-4+deb12u1+2

Patches

Patch: foss.heptapod.net ↗Patch: issues.oss-fuzz.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-hf7q-qx98-4hm7: GraphicsMagick before 8e56520 has a heap-based buffer over-read in ReadJXLImage in coders/jxl↗2025-04-09
▶
OSV
CVE-2025-32460: GraphicsMagick before 8e56520 has a heap-based buffer over-read in ReadJXLImage in coders/jxl↗2025-04-09
▶
CVEList
CVE-2025-32460: GraphicsMagick before 8e56520 has a heap-based buffer over-read in ReadJXLImage in coders/jxl↗2025-04-09
▶

📋Vendor Advisories

1
Debian
CVE-2025-32460: graphicsmagick - GraphicsMagick before 8e56520 has a heap-based buffer over-read in ReadJXLImage ...↗2025
▶