Heap-Based Buffer Over-Read Vulnerability in GraphicsMagick
Summary
CVE-2025-32460: GraphicsMagick before 8e56520 has a heap-based buffer over-read in ReadJXLImage in coders/jxl.c, related to an ImportViewPixelArea call. Affects graphicsmagick versions < 1.4+really1.3.40-4+deb12u1. Fixed in 1.4+really1.3.40-4+deb12u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GraphicsMagick is a robust open-source software suite for image processing, widely used for its efficiency and versatility in handling various image formats. It provides tools for reading, writing, and manipulating images, making it a popular choice among developers and graphic designers. However, like many software packages, it is not immune to vulnerabilities that can compromise its functionality and security.
Vulnerability Detail
The vulnerability identified as CVE-2025-32460 is a heap-based buffer over-read occurring in the ReadJXLImage function within the coders/jxl.c file of GraphicsMagick. This issue arises from an improper handling of memory during an ImportViewPixelArea call, which can lead to potential information leakage or application crashes. Attackers exploiting this vulnerability could manipulate image files to trigger the over-read, potentially exposing sensitive data or causing instability in applications relying on GraphicsMagick.
How To Fix
Minimum fixed version
1.4+really1.3.40-4+deb12u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade graphicsmagickTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid processing untrusted or potentially malicious image files until the package is updated. Additionally, consider implementing strict input validation and sanitization to minimize the risk of exploitation.
Conclusion
The CVE-2025-32460 vulnerability in GraphicsMagick poses significant risks due to its potential for heap-based buffer over-reads. Users are strongly advised to update to the latest version of the software to protect against exploitation. For those unable to update immediately, implementing workarounds can help mitigate risks until a patch is applied.
See every vulnerability recorded for graphicsmagick →
FAQ
CVE-2025-32460 is a vulnerability in GraphicsMagick that allows for a heap-based buffer over-read, potentially leading to information leakage or application crashes.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The risks include potential exposure of sensitive data and application instability, which could lead to denial of service or other security breaches.
Yes, a patched version of GraphicsMagick is available. Users should update to the latest version to mitigate the vulnerability.
If immediate updating is not possible, avoid processing untrusted image files and implement strict input validation to reduce the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for graphicsmagick.
