CVE-2025-27795 Details
Description
ReadJXLImage in JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.
A vulnerability exists in GraphicsMagick in the JXL image decoder, prior to version 1.3.46, where image dimension resource limits are not enforced. This oversight can lead to excessive memory consumption when decoding JPEG XL images with large dimensions. For instance, a crafted JXL file can cause the decoder to use nearly 4 billion bytes of heap memory, surpassing typical resource limits and causing out-of-memory errors. This vulnerability was identified during fuzz testing and is associated with OSS-Fuzz issue #69728.
Users are advised to update to GraphicsMagick version 1.3.46 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 7, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| graphicsmagick graphicsmagick | < 1.3.46 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jan 29, 2026 | Initial Analysis | [email protected] |
| Mar 7, 2025 | CVE Modified | [email protected] |
| Mar 7, 2025 | New CVE Received | [email protected] |