CVE-2025-27795

NameCVE-2025-27795
DescriptionReadJXLImage in JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1099955

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
graphicsmagick (PTS)bullseye (security), bullseye1.4+really1.3.36+hg16481-2+deb11u1fixed
bookworm1.4+really1.3.40-4vulnerable
sid, trixie1.4+really1.3.45+hg17696-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
graphicsmagicksourcebullseye(not affected)
graphicsmagicksource(unstable)1.4+really1.3.45+hg17689-11099955

Notes

[bullseye] - graphicsmagick <not-affected> (Vulnerable code only introduced in 1.3.38)
https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/9bbae7314e3c3b19b830591010ed90bb136b9c42

Search for package or bug name: Reporting problems