What’s Vulnerable › Vulnerabilities

CVE-2025-32460

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-04-09 · updated 2026-06-17
• Weakness: CWE-125

Description

GraphicsMagick before 8e56520 has a heap-based buffer over-read in ReadJXLImage in coders/jxl.c, related to an ImportViewPixelArea call.

Affected products

• GraphicsMagick: before 1.3.46 — fixed in 1.3.46

How to fix

Upgrade to a fixed version: GraphicsMagick 1.3.46. Check the vendor advisory for mitigations.

References

• https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/8e56520435df50f618a03f2721a39a70a515f1cb
• https://issues.oss-fuzz.com/issues/406320404
• https://tracker.debian.org/news/1636753/accepted-graphicsmagick-14really1345hg17696-1-source-into-unstable/

Get alerted when CVE-2025-32460 or the next vulnerability affects your stack