Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-725n-u2ss-ayda
Vulnerability ID VCID-725n-u2ss-ayda
Aliases CVE-2025-27795
Summary ReadJXLImage in JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-770 Allocation of Resources Without Limits or Throttling
System Score Found at
epss 0.00079 https://api.first.org/data/v1/epss?cve=CVE-2025-27795
epss 0.00079 https://api.first.org/data/v1/epss?cve=CVE-2025-27795
epss 0.00079 https://api.first.org/data/v1/epss?cve=CVE-2025-27795
epss 0.00079 https://api.first.org/data/v1/epss?cve=CVE-2025-27795
epss 0.00079 https://api.first.org/data/v1/epss?cve=CVE-2025-27795
epss 0.00079 https://api.first.org/data/v1/epss?cve=CVE-2025-27795
epss 0.00327 https://api.first.org/data/v1/epss?cve=CVE-2025-27795
epss 0.00327 https://api.first.org/data/v1/epss?cve=CVE-2025-27795
epss 0.00327 https://api.first.org/data/v1/epss?cve=CVE-2025-27795
epss 0.00327 https://api.first.org/data/v1/epss?cve=CVE-2025-27795
epss 0.00327 https://api.first.org/data/v1/epss?cve=CVE-2025-27795
epss 0.00327 https://api.first.org/data/v1/epss?cve=CVE-2025-27795
epss 0.00327 https://api.first.org/data/v1/epss?cve=CVE-2025-27795
epss 0.00327 https://api.first.org/data/v1/epss?cve=CVE-2025-27795
cvssv3.1 4.3 https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/9bbae7314e3c3b19b830591010ed90bb136b9c42
ssvc Track https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/9bbae7314e3c3b19b830591010ed90bb136b9c42
cvssv3.1 4.3 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 4.3 https://github.com/libjxl/libjxl/issues/3792#issuecomment-2330978387
ssvc Track https://github.com/libjxl/libjxl/issues/3792#issuecomment-2330978387
cvssv3.1 4.3 https://github.com/libjxl/libjxl/issues/3793#issuecomment-2334843280
ssvc Track https://github.com/libjxl/libjxl/issues/3793#issuecomment-2334843280
cvssv3.1 4.3 https://issues.oss-fuzz.com/issues/42536330#comment6
ssvc Track https://issues.oss-fuzz.com/issues/42536330#comment6
cvssv3.1 4.3 http://www.graphicsmagick.org/NEWS.html
ssvc Track http://www.graphicsmagick.org/NEWS.html
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2025-27795
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
1099955 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1099955
3792#issuecomment-2330978387 https://github.com/libjxl/libjxl/issues/3792#issuecomment-2330978387
3793#issuecomment-2334843280 https://github.com/libjxl/libjxl/issues/3793#issuecomment-2334843280
42536330#comment6 https://issues.oss-fuzz.com/issues/42536330#comment6
9bbae7314e3c3b19b830591010ed90bb136b9c42 https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/9bbae7314e3c3b19b830591010ed90bb136b9c42
NEWS.html http://www.graphicsmagick.org/NEWS.html
USN-7433-1 https://usn.ubuntu.com/7433-1/
No exploits are available.
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L Found at https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/9bbae7314e3c3b19b830591010ed90bb136b9c42
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-07T19:37:23Z/ Found at https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/9bbae7314e3c3b19b830591010ed90bb136b9c42
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L Found at https://github.com/libjxl/libjxl/issues/3792#issuecomment-2330978387
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-07T19:37:23Z/ Found at https://github.com/libjxl/libjxl/issues/3792#issuecomment-2330978387
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L Found at https://github.com/libjxl/libjxl/issues/3793#issuecomment-2334843280
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-07T19:37:23Z/ Found at https://github.com/libjxl/libjxl/issues/3793#issuecomment-2334843280
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L Found at https://issues.oss-fuzz.com/issues/42536330#comment6
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-07T19:37:23Z/ Found at https://issues.oss-fuzz.com/issues/42536330#comment6
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L Found at http://www.graphicsmagick.org/NEWS.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-07T19:37:23Z/ Found at http://www.graphicsmagick.org/NEWS.html
Exploit Prediction Scoring System (EPSS)
Percentile 0.23459
EPSS Score 0.00079
Published At April 16, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T17:10:24.113483+00:00 Ubuntu USN Importer Import https://usn.ubuntu.com/7433-1/ 38.0.0