Log in Start free

Vulnerability · Published Jul 8, 2025 · Assigned by redhat

CVE-2025-7345Gdk‑pixbuf: heap‑buffer‑overflow in gdk‑pixbuf

High 7.5

In plain English

A high-severity buffer overflow in gdk-pixbuf. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.3%top 28.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A flaw exists in gdk‑pixbuf within the gdk_pixbuf__jpeg_image_load_increment function (io-jpeg.c) and in glib’s g_base64_encode_step (glib/gbase64.c). When processing maliciously crafted JPEG images, a heap buffer overflow can occur during Base64 encoding, allowing out-of-bounds reads from heap memory, potentially causing application crashes or arbitrary code execution.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8gdk-pixbuf22.36.12-7.el8_10ALSA-2025:13315
AlmaLinux:8gdk-pixbuf2-devel2.36.12-7.el8_10ALSA-2025:13315
AlmaLinux:8gdk-pixbuf2-modules2.36.12-7.el8_10ALSA-2025:13315
AlmaLinux:8gdk-pixbuf2-xlib2.36.12-7.el8_10ALSA-2025:13315
AlmaLinux:8gdk-pixbuf2-xlib-devel2.36.12-7.el8_10ALSA-2025:13315
Debian:12gdk-pixbuf2.42.10+dfsg-1+deb12u3DEBIAN-CVE-2025-7345
Debian:13gdk-pixbuf2.42.12+dfsg-4DEBIAN-CVE-2025-7345
Debian:14gdk-pixbuf2.42.12+dfsg-4DEBIAN-CVE-2025-7345
Rocky Linux:10gdk-pixbuf20:2.42.12-4.el10_0RLSA-2025:12862
Rocky Linux:8gdk-pixbuf20:2.36.12-7.el8_10RLSA-2025:13315
Rocky Linux:9gdk-pixbuf20:2.42.6-6.el9_6RLSA-2025:12841
Ubuntu:22.04:LTSgdk-pixbuf2.42.8+dfsg-1ubuntu0.4USN-7662-1
Ubuntu:22.04:LTSgdk-pixbuf2.42.8+dfsg-1ubuntu0.4UBUNTU-CVE-2025-7345
Ubuntu:24.04:LTSgdk-pixbuf2.42.10+dfsg-3ubuntu3.2UBUNTU-CVE-2025-7345
Ubuntu:24.04:LTSgdk-pixbuf2.42.10+dfsg-3ubuntu3.2USN-7662-1
Ubuntu:25.10gdk-pixbuf2.42.12+dfsg-4build1UBUNTU-CVE-2025-7345

Affected products (as reported)

VendorProductVersions
gdk-pixbuf 0 – before 2.43.4
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support see references
Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support see references
Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On see references
Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support see references
Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service see references
Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service see references
Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support see references
Red Hat Red Hat Enterprise Linux 6 see references

Weakness: CWE-120 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References