CVE-2025-6199

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-6199
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-6199.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-6199
Downstream
Related
Published
2025-06-17T14:30:42.665Z
Modified
2026-07-15T01:49:00.857439858Z
Severity
  • 3.3 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Gdk-pixbuf: uninitialized memory disclosure in gdkpixbuf gif lzw decoder
Details

A flaw was found in the GIF parser of GdkPixbuf’s LZW decoder. When an invalid symbol is encountered during decompression, the decoder sets the reported output size to the full buffer length rather than the actual number of written bytes. This logic error results in uninitialized sections of the buffer being included in the output, potentially leaking arbitrary memory contents in the processed image.

Database specific 
{
    "cwe_ids": [
        "CWE-200"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/6xxx/CVE-2025-6199.json",
    "cna_assigner": "redhat"
}
References

Affected packages

Git / gitlab.gnome.org/gnome/gdk-pixbuf

Affected ranges

Type
GIT
Repo
https://gitlab.gnome.org/gnome/gdk-pixbuf
Events
Introduced
0714dd66124139e187eb58f3de6ec4de0753d921
Fixed
dba085b0d58435808c49279f9fb3f08e07d43541
Database specific 
{
    "cpe": "cpe:2.3:a:gnome:gdkpixbuf:2.0.0:-:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.43.2"
        },
        {
            "introduced": "2.0.0-NA"
        },
        {
            "last_affected": "2.0.0-NA"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_STRING"
    ]
}

Affected versions

2.*
2.0.0-NA

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-6199.json"