CVE-2025-6199
Last modified
CVE-2025-6199 is a low-severity vulnerability rated 3.3/10 on the CVSS scale. A flaw was found in the GIF parser of GdkPixbuf’s LZW decoder. When an invalid symbol is encountered during decompression, the decoder sets the reported output size to the full buffer length rather than the actual number of written bytes. EPSS estimates a 0.15% chance of exploitation in the next 30 days.
Description
A flaw was found in the GIF parser of GdkPixbuf’s LZW decoder. When an invalid symbol is encountered during decompression, the decoder sets the reported output size to the full buffer length rather than the actual number of written bytes. This logic error results in uninitialized sections of the buffer being included in the output, potentially leaking arbitrary memory contents in the processed image.
Metrics
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Gnome | Gdkpixbuf | 2.0.0 |
References
- https://access.redhat.com/security/cve/CVE-2025-6199Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2373147Issue Tracking, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2025-6199?
How severe is CVE-2025-6199?
How do I fix CVE-2025-6199?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-6198There is a vulnerability in the Supermicro BMC firmware vali…7.2
- CVE-2025-61982An arbitrary code execution vulnerability exists in the Code…7.8
- CVE-2025-61983Heap-based Buffer Overflow vulnerability in TP-Link Archer A…8
- CVE-2025-61984ssh in OpenSSH before 10.1 allows control characters in user…3.6
- CVE-2025-61985ssh in OpenSSH before 10.1 allows the '\0' character in an s…3.6
- CVE-2025-61987GroupSession Free edition prior to ver5.3.0, GroupSession by…6.9
- CVE-2025-61990When using a multi-bladed platform with more than one blade,…8.7
- CVE-2025-61994Cross-site scripting vulnerability exists in GROWI prior to …5.4
- CVE-2025-61996OPEXUS FOIAXpress before 11.13.3.0 allows an administrative …4.8
- CVE-2025-61997OPEXUS FOIAXpress before 11.13.3.0 allows an administrative …4.8
- CVE-2025-61998OPEXUS FOIAXpress before 11.13.3.0 allows an administrative …4.8
- CVE-2025-61999OPEXUS FOIAXpress before 11.13.3.0 allows an administrative …4.8
Are you affected by CVE-2025-6199?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST