CVE-2025-27795
📋 TL;DR
This vulnerability in GraphicsMagick's JXL image processing lacks proper dimension limits when reading JXL files, allowing attackers to cause excessive memory allocation. It affects systems using GraphicsMagick to process untrusted JXL images. The impact is denial of service through resource exhaustion.
💻 Affected Systems
- GraphicsMagick
📦 What is this software?
Graphicsmagick by Graphicsmagick
⚠️ Risk & Real-World Impact
Worst Case
Complete system memory exhaustion leading to denial of service and potential system instability or crash.
Likely Case
Application crashes or becomes unresponsive when processing specially crafted JXL images with excessive dimensions.
If Mitigated
Limited impact with proper resource limits and input validation in place.
🎯 Exploit Status
Exploitation requires ability to supply malicious JXL files to vulnerable systems. No authentication bypass needed if file upload/processing is available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.3.46
Vendor Advisory: http://www.graphicsmagick.org/NEWS.html
Restart Required: No
Instructions:
1. Download GraphicsMagick 1.3.46 or later from official sources. 2. Compile and install following standard build procedures. 3. Replace existing GraphicsMagick installation with patched version. 4. No service restart needed for most applications.
🔧 Temporary Workarounds
Disable JXL support
allDisable JXL format processing in GraphicsMagick configuration
Recompile GraphicsMagick with --without-jxl flag or modify configuration to disable JXL format
Implement input validation
allAdd dimension validation before processing JXL files
Implement file validation in application code to check image dimensions before passing to GraphicsMagick
🧯 If You Can't Patch
- Implement strict file upload restrictions for JXL files
- Deploy resource limits (memory, CPU) on processes using GraphicsMagick
🔍 How to Verify
Check if Vulnerable:
Check GraphicsMagick version: gm -version | grep 'GraphicsMagick'Check Version:
gm -version | grep 'GraphicsMagick'Verify Fix Applied:
Verify version is 1.3.46 or later: gm -version | grep 'GraphicsMagick'📡 Detection & Monitoring
Log Indicators:
- High memory usage by GraphicsMagick processes
- Application crashes when processing JXL files
- Failed image processing operations
Network Indicators:
- Multiple JXL file uploads to vulnerable endpoints
- Unusual traffic patterns to image processing services
SIEM Query:
Process memory usage > threshold AND process_name contains 'gm' OR 'GraphicsMagick'🔗 References
- http://www.graphicsmagick.org/NEWS.html
- https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/9bbae7314e3c3b19b830591010ed90bb136b9c42
- https://github.com/libjxl/libjxl/issues/3792#issuecomment-2330978387
- https://github.com/libjxl/libjxl/issues/3793#issuecomment-2334843280
- https://issues.oss-fuzz.com/issues/42536330#comment6
