CVE-2025-27796

What it actually does

Out-of-bounds heap memory access caused by incorrect palette buffer allocation during WPG image parsing in ReadWPGImage.

Why it matters to the business

Applications processing untrusted images may crash or allow arbitrary code execution, increasing risk of service outages or system compromise; the issue affects widely used compiler toolchains on RHEL 8 with moderate downstream prevalence.

How an attack unfolds

An attacker crafts a malicious WPG image file that triggers improper buffer sizing in palette handling, causing ReadBlob to read or write beyond allocated heap memory when the image is opened by any application using the vulnerable GraphicsMagick library.

How to fix it

Update affected RHEL 8 packages to the listed fixed versions including clang 0:12.0.1-4.module+el8.5.0+13246+cefb5d4c and related compiler-rt/libomp/lld packages at their respective fixed builds; rebuild or recompile any dependent applications after upgrade.

How to confirm the fix worked

Verify package versions match or exceed the stated fixed builds using rpm or dnf; test image parsing with known-good and boundary WPG samples to confirm no crashes or abnormal memory behavior.

Typical attack path

1. Attacker prepares a specially malformed WPG image file
2. Victim application or service opens or processes the image using affected GraphicsMagick code
3. ReadWPGImage mishandles palette buffer allocation leading to out-of-bounds access
4. Memory corruption occurs enabling potential crash or code execution

How to detect it

Review application logs and crash reports for segmentation faults or heap errors when processing WPG files; monitor for unexpected process terminations involving image conversion or viewing tools.

What your security team should do

• Prioritize patching all listed RHEL 8 clang and related packages within standard change windows given the 582-day publication age and stable low EPSS
• Scan container and build images for the vulnerable package versions
• Add WPG image handling to allowed file type policies where feasible until patches are applied