CVE-2025-27796: Critical severity GraphicsMagick Graphicsmagick vulnerability
Published Mar 7, 2025
·Updated
Last updated 14 April 2025
Other sources
ReadWPGImage in WPG in GraphicsMagick before 1.3.46 mishandles palette buffer allocation, resulting in out-of-bounds access to heap memory in ReadBlob.
— NVD
Affected Software
3 affected componentsFixes available
GraphicsMagick Graphicsmagick<1.3.46
debian/graphicsmagick
1.4+really1.3.36+hg16481-2+deb11u11.4+really1.3.40-41.4+really1.3.40-4+deb12u11.4+really1.3.45+hg17696-1
GraphicsMagick Graphicsmagick<1.3.46
Remediation
Event History
Mar 7, 2025
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·06:15 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·06:15 AM
RemedyAffected Software
Apr 14, 2025
Data Sourced
via Ubuntu·05:42 AM
RemedyDescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-27796?
CVE-2025-27796 is considered a high-severity vulnerability due to its potential to lead to memory corruption.
2
How do I fix CVE-2025-27796?
To fix CVE-2025-27796, upgrade GraphicsMagick to version 1.3.46 or later.
3
What versions of GraphicsMagick are affected by CVE-2025-27796?
GraphicsMagick versions prior to 1.3.46 are affected by CVE-2025-27796.
4
What is the nature of the vulnerability described in CVE-2025-27796?
CVE-2025-27796 involves mishandling of palette buffer allocation in the WPG handler of GraphicsMagick.
5
Does CVE-2025-27796 affect ImageMagick?
CVE-2025-27796 specifically affects GraphicsMagick and not ImageMagick.