CVEvulnerability

CVE-2025-6199

3.3 LOW Published 2025-06-17 Modified 2026-06-30 Official page ↗
Status
Modified
Published
2025-06-17
Last modified
2026-06-30
Assigner
[email protected]
CVSS 3.1 ([email protected])
3.3 LOW — CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
CVSS 3.1 ([email protected])
3.3 LOW — CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Weaknesses
CWE-200

Description

A flaw was found in the GIF parser of GdkPixbuf’s LZW decoder. When an invalid symbol is encountered during decompression, the decoder sets the reported output size to the full buffer length rather than the actual number of written bytes. This logic error results in uninitialized sections of the buffer being included in the output, potentially leaking arbitrary memory contents in the processed image.

Affected configurations

• gnome gdkpixbuf 2.0.0

Related

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References