PT-2025-15667 · Unknown+3 · Graphicsmagick+3

Laszlo Boszormenyi · Published 2025-04-09 · Updated 2026-05-13 · CVE-2025-32460

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions: GraphicsMagick versions prior to 8e56520

Description: The issue is related to a heap-based buffer over-read in the ReadJXLImage function in coders/jxl.c, which is connected to an ImportViewPixelArea call.

Recommendations: For versions prior to 8e56520, update to a version that includes the fix for the heap-based buffer over-read issue.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BDU:2025-16109

CVE-2025-32460

DSA-5905-1

JLSEC-2026-495

MGASA-2025-0148

OESA-2025-1506

OPENSUSE-SU-2025:14993-1

OPENSUSE-SU-2025_1349-1

SUSE-SU-2025:1349-1

Affected Products

Debian

Graphicsmagick

Red Os

Suse

References · 38

• https://security-tracker.debian.org/tracker/CVE-2025-32460 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-16109 · Security Note
• https://osv.dev/vulnerability/CVE-2025-32460 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-32460 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-32460 · Security Note
• https://osv.dev/vulnerability/JLSEC-2026-495 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5905-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-32460 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2025-0148 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27795 · Security Note
• https://issues.oss-fuzz.com/issues/406320404 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2025:14993-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-32460 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:1349-1 · Vendor Advisory
• https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/8e56520435df50f618a03f2721a39a70a515f1cb · Patch