What is GHSA-fmhh-rw3h-785m?

GHSA-fmhh-rw3h-785m is a security advisory published by GitHub Security Advisories with Medium severity. bep/imagemeta allows a potentially large memory allocation in PNG and WebP parsing

Which CVE IDs does GHSA-fmhh-rw3h-785m cover?

GHSA-fmhh-rw3h-785m covers the following CVE IDs: CVE-2025-32025. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-fmhh-rw3h-785m?

GHSA-fmhh-rw3h-785m affects 1 product, including: go/github.com/bep/imagemeta:\u003c 0.11.0.

GHSA-fmhh-rw3h-785mMedium

bep/imagemeta allows a potentially large memory allocation in PNG and WebP parsing

Vendor

GitHub Security Advisories

Published

April 9, 2025

Last Modified

April 9, 2025

🔗 CVE IDs covered (1)

CVE-2025-32025 →

📋 Description

Impact

The buffer created for parsing metadata for PNG and WebP images was only bounded by their input data type, which could lead to potentially large memory allocation, and unreasonably high for image metadata. Before v0.11.0, If you didn't trust the input images, this could be abused to construct denial-of-service attacks.

Patches

v0.11.0 added a 10 MB upper limit.

🎯 Affected products1

go/github.com/bep/imagemeta:< 0.11.0

🔗 References (4)

https://github.com/bep/imagemeta/security/advisories/GHSA-fmhh-rw3h-785m
https://nvd.nist.gov/vuln/detail/CVE-2025-32025
https://github.com/bep/imagemeta/commit/ee0de9b029f4e82106729f69559f27c9a404229d
https://github.com/advisories/GHSA-fmhh-rw3h-785m