CVE-2025-27796: Critical severity GraphicsMagick Graphicsmagick vulnerability
Last updated 14 April 2025
Other sources
ReadWPGImage in WPG in GraphicsMagick before 1.3.46 mishandles palette buffer allocation, resulting in out-of-bounds access to heap memory in ReadBlob.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/graphicsmagickto a version that resolves this vulnerability.Fixed in 1.4+really1.3.36+hg16481-2+deb11u1Fixed in 1.4+really1.3.40-4Fixed in 1.4+really1.3.40-4+deb12u1Fixed in 1.4+really1.3.45+hg17696-1 - Upgrade
Upgrade
GraphicsMagick (ReadWPGImage / WPG)to a version that resolves this vulnerability.Fixed in 1.3.46
Event History
Frequently Asked Questions
What is the severity of CVE-2025-27796?
CVE-2025-27796 is considered a high-severity vulnerability due to its potential to lead to memory corruption.
How do I fix CVE-2025-27796?
To fix CVE-2025-27796, upgrade GraphicsMagick to version 1.3.46 or later.
What versions of GraphicsMagick are affected by CVE-2025-27796?
GraphicsMagick versions prior to 1.3.46 are affected by CVE-2025-27796.
What is the nature of the vulnerability described in CVE-2025-27796?
CVE-2025-27796 involves mishandling of palette buffer allocation in the WPG handler of GraphicsMagick.
Does CVE-2025-27796 affect ImageMagick?
CVE-2025-27796 specifically affects GraphicsMagick and not ImageMagick.