CVE-2025-32460 — MEDIUM (4.0)

Q: What is CVE-2025-32460?

CVE-2025-32460 is a vulnerability with a CVSS score of 4.0 (MEDIUM). GraphicsMagick before 8e56520 has a heap-based buffer over-read in ReadJXLImage in coders/jxl.c, related to an ImportViewPixelArea call.

Q: How severe is CVE-2025-32460?

CVE-2025-32460 has been rated MEDIUM with a CVSS base score of 4.0/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2025-32460?

Check the references section above for vendor advisories and patch information. Affected products include: Graphicsmagick Graphicsmagick.

Vulnerability Description

GraphicsMagick before 8e56520 has a heap-based buffer over-read in ReadJXLImage in coders/jxl.c, related to an ImportViewPixelArea call.

CVSS Score

4.0

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

LOW

Availability

NONE

Affected Products

Vendor	Product	Versions
Graphicsmagick	Graphicsmagick	< 1.3.46

Related Weaknesses (CWE)

CWE-125

References

https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/8e56520435df50fPatch
https://issues.oss-fuzz.com/issues/406320404ExploitIssue TrackingPatch
https://tracker.debian.org/news/1636753/accepted-graphicsmagick-14really1345hg17Mailing List

FAQ

What is CVE-2025-32460?

CVE-2025-32460 is a vulnerability with a CVSS score of 4.0 (MEDIUM). GraphicsMagick before 8e56520 has a heap-based buffer over-read in ReadJXLImage in coders/jxl.c, related to an ImportViewPixelArea call.

How severe is CVE-2025-32460?

CVE-2025-32460 has been rated MEDIUM with a CVSS base score of 4.0/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2025-32460?

Check the references section above for vendor advisories and patch information. Affected products include: Graphicsmagick Graphicsmagick.