CVE-2025-27796

NameCVE-2025-27796
DescriptionReadWPGImage in WPG in GraphicsMagick before 1.3.46 mishandles palette buffer allocation, resulting in out-of-bounds access to heap memory in ReadBlob.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1099954

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
graphicsmagick (PTS)bullseye (security), bullseye1.4+really1.3.36+hg16481-2+deb11u1fixed
bookworm1.4+really1.3.40-4fixed
sid, trixie1.4+really1.3.45+hg17696-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
graphicsmagicksourcebullseye(not affected)
graphicsmagicksourcebookworm(not affected)
graphicsmagicksource(unstable)1.4+really1.3.45+hg17689-11099954

Notes

[bookworm] - graphicsmagick <not-affected> (Vulnerable code only introduced in 1.3.43)
[bullseye] - graphicsmagick <not-affected> (Vulnerable code only introduced in 1.3.43)
Introduced by: https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/a2be6a996a8c190bc75db02a74a93dcab813e9c4 (GraphicsMagick-1_3_43)
Fixed by: https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/883ebf8cae6dfa5873d975fe3476b1a188ef3f9f
https://sourceforge.net/p/graphicsmagick/mailman/message/59169987/

Search for package or bug name: Reporting problems