CVE-2025-27796
Fixed in a distro release EPSS <1%CVSS 4.5
ReadWPGImage in WPG in GraphicsMagick before 1.3.46 mishandles palette buffer allocation, resulting in out-of-bounds access to heap memory in ReadBlob.
Products: graphicsmagick
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2023 | GraphicsMagick | 1.3.45-1.amzn2023.0.1 |
| Amazon Linux 2023 | GraphicsMagick-c++ | 1.3.45-1.amzn2023.0.1 |
| Amazon Linux 2023 | GraphicsMagick-c++-devel | 1.3.45-1.amzn2023.0.1 |
| Amazon Linux 2023 | GraphicsMagick-devel | 1.3.45-1.amzn2023.0.1 |
| Amazon Linux 2023 | GraphicsMagick-doc | 1.3.45-1.amzn2023.0.1 |
| Amazon Linux 2023 | GraphicsMagick-perl | 1.3.45-1.amzn2023.0.1 |
| Chainguard | graphicsmagick-compat | 1.3.46-r0 |
| Debian 13 | graphicsmagick | 1.4+really1.3.45+hg17689-1 |
| Debian 14 | graphicsmagick | 1.4+really1.3.45+hg17689-1 |
| Ubuntu Pro 22.04 LTS | graphicsmagick | 1.4+really1.3.38-1ubuntu0.1+esm1 |
| Ubuntu Pro 24.04 LTS | graphicsmagick | 1.4+really1.3.42-1.1ubuntu0.1~esm1 |
| Wolfi | graphicsmagick-compat | 1.3.46-r0 |
| openSUSE Tumbleweed | GraphicsMagick | 1.3.45-2.1 |