{"id":"JLSEC-2026-494","summary":"WPG in GraphicsMagick before 1.3.46 mishandles palette buffer allocation.","details":"ReadWPGImage in WPG in GraphicsMagick before 1.3.46 mishandles palette buffer allocation, resulting in out-of-bounds access to heap memory in ReadBlob.","modified":"2026-07-18T00:02:07.169324383Z","published":"2026-05-13T01:42:44.063Z","upstream":["CVE-2025-27796","GHSA-v5xf-gj23-85jx","EUVD-2025-6239"],"database_specific":{"license":"CC-BY-4.0","sources":[{"html_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27796","database_specific":{"status":"Analyzed"},"id":"CVE-2025-27796","imported":"2026-07-17T22:00:30.237Z","modified":"2026-06-17T09:04:14.400Z","published":"2025-03-07T06:15:35.620Z","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2025-27796"},{"published":"2025-03-07T06:30:33Z","url":"https://api.github.com/advisories/GHSA-v5xf-gj23-85jx","html_url":"https://github.com/advisories/GHSA-v5xf-gj23-85jx","id":"GHSA-v5xf-gj23-85jx","imported":"2026-07-17T22:00:30.392Z","modified":"2025-03-07T18:32:10Z"},{"imported":"2026-07-17T22:00:31.565Z","modified":"2025-03-07T21:32:29Z","published":"2025-03-07T00:00:00Z","url":"https://euvdservices.enisa.europa.eu/api/enisaid?id=EUVD-2025-6239","html_url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-6239","id":"EUVD-2025-6239"}]},"references":[{"type":"WEB","url":"http://www.graphicsmagick.org/NEWS.html"},{"type":"WEB","url":"https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/883ebf8cae6dfa5873d975fe3476b1a188ef3f9f"},{"type":"WEB","url":"https://github.com/advisories/GHSA-v5xf-gj23-85jx"},{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27796"},{"type":"WEB","url":"https://sourceforge.net/p/graphicsmagick/bugs/750"},{"type":"WEB","url":"https://sourceforge.net/p/graphicsmagick/bugs/750/"}],"affected":[{"package":{"name":"GraphicsMagick_jll","ecosystem":"Julia","purl":"pkg:julia/GraphicsMagick_jll?uuid=aa65733b-c888-5e24-8545-c87abc10c960"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.3.47+0"}]}],"database_specific":{"source":"https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-494.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}