CVE-2025-27796 is a medium severity (CVSS 4.5) memory safety flaw in GraphicsMagick before 1.3.46. The WPG image reader, ReadWPGImage, mishandles palette buffer allocation, which causes out-of-bounds access to heap memory in ReadBlob. Upgrade to 1.3.46 or later and review where your systems process untrusted images.
What's affected
The record says GraphicsMagick before 1.3.46 is affected, so 1.3.46 is the first release that carries the fix. The project's NEWS file and the linked commit and bug report describe the change.
The vector is local (AV:L) with high attack complexity and a changed scope. Impact scores are limited to low integrity and low availability, with none for confidentiality. That is why this is rated medium, even though it is a memory safety bug in a library that often handles files from outside.
Severity in the record: medium, CVSS 4.5, vector CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L. Weakness classes: CWE-908 (Use of uninitialized resource).
How to check if you're exposed
Check the installed version directly:
gm version
gm convert -version
On Debian or Ubuntu, dpkg -l | grep -i graphicsmagick shows the packaged version, and on Fedora or Red Hat systems rpm -qa | grep -i graphicsmagick does the same. Distributions often backport fixes without changing the upstream version number, so check your vendor's security tracker for this CVE before concluding you are behind.
If GraphicsMagick is embedded in a container image or a language binding, scan the image. The demo below shows how an image scan finds system libraries like this one. The free in-browser dependency scan at gold.safeguard.sh/scan covers your application packages.
What to do now
- Upgrade GraphicsMagick to 1.3.46 or later, or to your distribution's patched package.
- Rebuild and redeploy any container image that bundles GraphicsMagick, since the old layer keeps the old library.
- If you accept image uploads, restrict the formats you decode. Reject WPG files if you do not need them, using a policy file or an explicit allow list of formats.
- Run image conversion in a sandboxed process with limited memory, no network and a short time limit.
- Re-scan your images and hosts afterwards to confirm the old version is gone.
Why it matters
CWE-908 is the use of a resource that was not initialised. In this case the record describes a palette buffer that is allocated incorrectly, so reading the file leads to access to heap memory outside what was meant. Image decoders are a classic place for this kind of bug, because the file format controls sizes and counts that the code then trusts.
A medium score does not mean ignore it. Image libraries sit behind upload forms, thumbnail jobs and document converters, and a file that arrives from the internet is a normal input there. The question to ask is whether any of your systems pass untrusted files to GraphicsMagick, and whether the WPG format needs to be enabled at all.
The record does not flag this CVE as known exploited (it is not on the CISA Known Exploited Vulnerabilities list as of the record), so treat it as a patching priority rather than an active incident, and keep watching the advisory.
Try it yourself
This demo scans a container image and shows how a system library such as GraphicsMagick shows up in the results with its version and fixed release.
Click through it at your own pace, or open it full screen.
Quick check
Which release fixes CVE-2025-27796?
GraphicsMagick 1.3.46, since the record says versions before it are affected. Distribution packages may carry the fix under an older version number.
Does a local vector mean it cannot be reached through a web upload?
Not necessarily. The vector describes how the vulnerable code is reached. If a web service passes uploaded files to GraphicsMagick, the file becomes the local input. Check how your own service uses the library.
Sources
Last reviewed: 19 October 2026.
