Information disclosure in Gnome Gdkpixbuf
CVE-2025-6199
A flaw was found in the GIF parser of GdkPixbuf’s LZW decoder. When an invalid symbol is encountered during decompression, the decoder sets the reported output size to the full buffer length rather than the actual number of written bytes…
Vulnerability class: Information Disclosure
EPSS: 0.001 (4.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 3.3 (Low). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N.
Affected products
Weakness classification (CWE)
References
- secalert@redhat.com (x_refsource_REDHAT, Third Party Advisory, vdb-entry)
- secalert@redhat.com (x_refsource_REDHAT, issue-tracking, Third Party Advisory, Issue Tracking)
- af854a3a-2127-422b-91ae-364da2661108
- secalert@redhat.com
Frequently asked questions
- What is CVE-2025-6199?
- CVE-2025-6199 is a low-severity vulnerability in Gnome Gdkpixbuf, classified under Information Disclosure. CVSS score: 3.3/10. Published 2025-06-17.
- How severe is CVE-2025-6199?
- Low severity. CVSS v3 base score is 3.3 out of 10.