CVE-2025-32460 is a medium severity (CVSS 4.0) heap-based buffer over-read in GraphicsMagick. The bug is in ReadJXLImage in coders/jxl.c, which reads JPEG XL images, and is tied to an ImportViewPixelArea call. It is fixed in the source commit 8e56520. Update the package or rebuild from a newer source.
What's affected
GraphicsMagick before commit 8e56520, per the CVE record. The record does not give a release number, so use your package manager's advisory or the project's change log to map the commit to a release.
The flawed code is the JPEG XL reader. If your build does not include JPEG XL support, the code is not compiled in. If it does, any workflow that decodes untrusted JXL files is the place to look.
A Debian tracker entry is linked from the record and shows an accepted package update in the unstable distribution. Check your own distribution's tracker for the status in the release you run. The vector is local with no privileges needed, and the impact is limited integrity loss, which explains the medium score.
How to check if you're exposed
Find the installed version and check whether it was built with JPEG XL:
gm version
gm convert -list format | grep -i jxl
If the second command prints nothing, the JXL coder is not available in that build. If it prints a line, the build can read JXL files.
On Debian or Ubuntu, you can also compare the installed package with the distribution tracker:
dpkg -l graphicsmagick*
Remember to check container images that bundle GraphicsMagick for thumbnail or conversion jobs. They are easy to forget.
What to do now
- Update GraphicsMagick through your distribution, or build from a source tree that includes commit 8e56520.
- Rebuild and redeploy container images that include the library.
- If you convert files uploaded by users, disable JPEG XL decoding or reject that format until the update is in place.
- Run conversion jobs under a low-privilege account with limited file access.
- Add the library to your software inventory, since image tools are often pulled in by other packages.
Why it matters
The class is CWE-125 (Out-of-bounds Read). The decoder reads memory past the end of a buffer while importing pixel data. Read bugs like this commonly end in a crash, and they can sometimes expose nearby memory.
Image libraries sit behind many upload forms, thumbnail jobs and document converters. That is why a medium score on a local vector can still deserve a patch: the local reader is often a service that handles files from the internet.
The record does not mark this CVE as CISA KEV and makes no claim of exploitation in the wild.
Try it yourself
Libraries like this one hide inside container images. This demo shows how an image scan lists the packages in a layer and flags the vulnerable ones.
Click through it at your own pace, or open it full screen.
Quick check
Which release fixes this?
The record names a source commit, 8e56520, and not a release. Check the project's change log or your distribution's security tracker for the release that contains it.
Sources
- CVE-2025-32460 record on Safeguard Gold
- Fix commit in the GraphicsMagick repository
- OSS-Fuzz issue 406320404
- Debian tracker entry
Last reviewed: 18 October 2026.
