CVE-2025-27795

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

ReadJXLImage in JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

VendorProductVersions
GraphicsMagickGraphicsMagick< 1.3.46

References

Timeline

Published
Mar 7, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-277969.8ReadWPGImage in WPG in GraphicsMagick before 1.3.46 mishandles palette buffer allocation, resulting in out-of-bounds access to heap memory iCVE-2025-277979.8OS command injection vulnerability in the specific service exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, an arbitrary OS commaCVE-2025-27808.8The Woffice Core plugin for WordPress, used by the Woffice Theme, is vulnerable to arbitrary file uploads due to missing file type validatioCVE-2025-278004.8The Episerver Content Management System (CMS) by Optimizely was affected by multiple Stored Cross-Site Scripting (XSS) vulnerabilities. ThisCVE-2025-278014.8The Episerver Content Management System (CMS) by Optimizely was affected by multiple Stored Cross-Site Scripting (XSS) vulnerabilities. ThisCVE-2025-278024.8The Episerver Content Management System (CMS) by Optimizely was affected by multiple Stored Cross-Site Scripting (XSS) vulnerabilities. ThisCVE-2025-278036.5The devices do not implement any authentication for the web interface or the MQTT server. An attacker who has network access to the device iCVE-2025-278046.5Several OS command injection vulnerabilities exist in the device firmware in the /var/salia/mqtt.php script. By publishing a specially craftCVE-2025-278079.1An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380,CVE-2025-278095.4Mbed TLS before 2.28.10 and 3.x before 3.6.3, on the client side, accepts servers that have trusted certificates for arbitrary hostnames unlCVE-2025-27816.3The WatchGuard Mobile VPN with SSL Client on Windows does not properly configure directory permissions when installed in a non-default direcCVE-2025-278104.8Mbed TLS before 2.28.10 and 3.x before 3.6.3, in some cases of failed memory allocation or hardware errors, uses uninitialized stack memory
CVE-2025-27795: High severity, CVSS 7.5 | Vulnix