CVE-2025-6199

Katalog CVE

CVSS 3.3 · Low EPSS 0,21%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada gnome gdkpixbuf. Skor CVSS 3.1 3.3 (Low) menurut NVD.

Deskripsi (NVD)

A flaw was found in the GIF parser of GdkPixbuf’s LZW decoder. When an invalid symbol is encountered during decompression, the decoder sets the reported output size to the full buffer length rather than the actual number of written bytes. This logic error results in uninitialized sections of the buffer being included in the output, potentially leaking arbitrary memory contents in the processed image.

Rincian

Terbit di NVD

17 Juni 2025

Terakhir diubah

30 Juni 2026

Status NVD

Modified

CVSS 3.1

3.3 (Low), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

0,21% peluang dieksploitasi; lebih tinggi dari 9,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2025-6199 advisory pihak ketiga
• https://bugzilla.redhat.com/show_bug.cgi?id=2373147 issue tracking · advisory pihak ketiga
• https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/257
• https://lists.debian.org/debian-lts-announce/2025/06/msg00023.html