CVE-2025-32460
Fixed in a distro release EPSS <1%CVSS 4.0
GraphicsMagick before 8e56520 has a heap-based buffer over-read in ReadJXLImage in coders/jxl.c, related to an ImportViewPixelArea call.
Products: graphicsmagick
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2023 | GraphicsMagick | 1.3.45-1.amzn2023.0.1 |
| Amazon Linux 2023 | GraphicsMagick-c++ | 1.3.45-1.amzn2023.0.1 |
| Amazon Linux 2023 | GraphicsMagick-c++-devel | 1.3.45-1.amzn2023.0.1 |
| Amazon Linux 2023 | GraphicsMagick-devel | 1.3.45-1.amzn2023.0.1 |
| Amazon Linux 2023 | GraphicsMagick-doc | 1.3.45-1.amzn2023.0.1 |
| Amazon Linux 2023 | GraphicsMagick-perl | 1.3.45-1.amzn2023.0.1 |
| Chainguard | graphicsmagick | no fix |
| Chainguard | graphicsmagick-compat | no fix |
| Chainguard | graphicsmagick-cpp | no fix |
| Chainguard | graphicsmagick-dev | no fix |
| Chainguard | graphicsmagick-doc | no fix |
| Debian 12 | graphicsmagick | 1.4+really1.3.40-4+deb12u1 |
| Debian 13 | graphicsmagick | 1.4+really1.3.45+hg17696-1 |
| Debian 14 | graphicsmagick | 1.4+really1.3.45+hg17696-1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | GraphicsMagick | 1.3.42-150600.3.7.1 |
| Ubuntu 25.10 | graphicsmagick | no fix |
| Ubuntu 26.04 LTS | graphicsmagick | no fix |
| Ubuntu 26.10 | graphicsmagick | no fix |
| Ubuntu Pro 14.04 LTS | graphicsmagick | no fix |
| Ubuntu Pro 16.04 LTS | graphicsmagick | no fix |
| Ubuntu Pro 18.04 LTS | graphicsmagick | no fix |
| Ubuntu Pro 20.04 LTS | graphicsmagick | no fix |
| Ubuntu Pro 22.04 LTS | graphicsmagick | no fix |
| Ubuntu Pro 24.04 LTS | graphicsmagick | no fix |
| Wolfi | graphicsmagick | no fix |
| Wolfi | graphicsmagick-compat | no fix |
| Wolfi | graphicsmagick-cpp | no fix |
| Wolfi | graphicsmagick-dev | no fix |
| Wolfi | graphicsmagick-doc | no fix |
| openSUSE Leap 15.6 | GraphicsMagick | 1.3.42-150600.3.7.1 |
| openSUSE Tumbleweed | GraphicsMagick | 1.3.45-3.1 |