CVE-2025-27796 — MEDIUM (4.5)

Q: What is CVE-2025-27796?

CVE-2025-27796 is a vulnerability with a CVSS score of 4.5 (MEDIUM). ReadWPGImage in WPG in GraphicsMagick before 1.3.46 mishandles palette buffer allocation, resulting in out-of-bounds access to heap memory in ReadBlob.

Q: How severe is CVE-2025-27796?

CVE-2025-27796 has been rated MEDIUM with a CVSS base score of 4.5/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2025-27796?

Check the references section above for vendor advisories and patch information. Affected products include: Graphicsmagick Graphicsmagick.

Vulnerability Description

ReadWPGImage in WPG in GraphicsMagick before 1.3.46 mishandles palette buffer allocation, resulting in out-of-bounds access to heap memory in ReadBlob.

CVSS Score

4.5

MEDIUM

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality

NONE

Integrity

LOW

Availability

LOW

Affected Products

Vendor	Product	Versions
Graphicsmagick	Graphicsmagick	< 1.3.46

Related Weaknesses (CWE)

CWE-908

References

http://www.graphicsmagick.org/NEWS.htmlRelease Notes
https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/883ebf8cae6dfa5Patch
https://sourceforge.net/p/graphicsmagick/bugs/750/Permissions Required

FAQ

What is CVE-2025-27796?

CVE-2025-27796 is a vulnerability with a CVSS score of 4.5 (MEDIUM). ReadWPGImage in WPG in GraphicsMagick before 1.3.46 mishandles palette buffer allocation, resulting in out-of-bounds access to heap memory in ReadBlob.

How severe is CVE-2025-27796?

CVE-2025-27796 has been rated MEDIUM with a CVSS base score of 4.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2025-27796?

Check the references section above for vendor advisories and patch information. Affected products include: Graphicsmagick Graphicsmagick.