Critical Resource Limit Vulnerability in GraphicsMagick: CVE-2025-27795
Summary
CVE-2025-27795: ReadJXLImage in JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits. Affects graphicsmagick versions < 1.4+really1.3.40-4+deb12u1. Fixed in 1.4+really1.3.40-4+deb12u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GraphicsMagick is a powerful image processing software suite that provides a robust set of tools for creating, editing, and converting images. It is widely used in various applications due to its efficiency and versatility in handling different image formats. However, the recent discovery of a vulnerability in GraphicsMagick versions prior to 1.3.46 raises concerns regarding its ability to manage image dimensions, potentially leading to resource exhaustion.
Vulnerability Detail
CVE-2025-27795 is a vulnerability found in the JXL (JPEG XL) module of GraphicsMagick before version 1.3.46. This vulnerability arises from the lack of resource limits on image dimensions, which can be exploited by attackers to create specially crafted images that consume excessive system resources. The ramifications of this vulnerability include potential denial of service (DoS) attacks, where the affected system may become unresponsive or crash due to resource exhaustion. It is crucial for users to be aware of this vulnerability and take appropriate measures to mitigate its impact.
How To Fix
Minimum fixed version
1.4+really1.3.40-4+deb12u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade graphicsmagickTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the resources available to GraphicsMagick by configuring system resource limits or using containerization techniques to isolate the application. However, the best course of action is to update to the patched version as soon as possible.
Conclusion
CVE-2025-27795 presents a significant risk to users of GraphicsMagick versions prior to 1.3.46 due to its lack of resource limits on image dimensions. It is imperative for users to update to the latest version to safeguard their systems against potential denial of service attacks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for graphicsmagick →
FAQ
CVE-2025-27795 is a vulnerability in GraphicsMagick that allows for excessive resource consumption due to a lack of image dimension limits.
All versions of GraphicsMagick prior to 1.3.46 are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
The vulnerability can lead to denial of service (DoS) attacks, causing the affected system to become unresponsive or crash due to resource exhaustion.
If an immediate update is not possible, consider implementing resource limits or using containerization to mitigate the risk until you can upgrade.
Related vulnerabilities
Recent vulnerabilities recorded for graphicsmagick.
