CVE-2025-6199
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk4th percentile — higher than 4% of all known CVEs
Summary
A logic flaw was found in the GIF parser of GdkPixbuf's LZW decoder. When an invalid symbol is encountered during decompression, the decoder sets the reported output size to the full buffer length instead of the actual number of written bytes. This causes uninitialized buffer sections to be included in the output, potentially leaking arbitrary memory contents in the processed image.
Risk Assessment
The organization is at risk of leaking confidential data from the memory of the process handling GIF images. An attacker could exploit this vulnerability to read memory fragments containing keys, passwords, or other sensitive information.
Recommendation
Immediately update the GdkPixbuf library to a version containing the fix for the logic error in the LZW decoder. Until the update is applied, avoid processing GIF images from untrusted sources.
Original NVD description (English source)
A flaw was found in the GIF parser of GdkPixbuf’s LZW decoder. When an invalid symbol is encountered during decompression, the decoder sets the reported output size to the full buffer length rather than the actual number of written bytes. This logic error results in uninitialized sections of the buffer being included in the output, potentially leaking arbitrary memory contents in the processed image.