CVE-2025-27598

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

ImageSharp is a 2D graphics API. An Out-of-bounds Write vulnerability has been found in the ImageSharp gif decoder, allowing attackers to cause a crash using a specially crafted gif. This can potentially lead to denial of service. The problem has been patched. All users are advised to upgrade to v3.1.7 or v2.1.10.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
SixLabors	ImageSharp	< 2.1.10; >= 3.0.0, < 3.1.7

References

https://github.com/SixLabors/ImageSharp/issues/2859Exploit, Issue Tracking
https://github.com/SixLabors/ImageSharp/pull/2890Issue Tracking, Patch
https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-2cmq-823j-5qj8Vendor Advisory
https://github.com/SixLabors/ImageSharp/issues/2859Exploit, Issue Tracking

Timeline

Published: Mar 6, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-275996.5Element X Android is a Matrix Android Client provided by element.io. Prior to version 25.04.2, a crafted hyperlink on a webpage, or a locall CVE-2025-27607.8GIMP XWD File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary CVE-2025-276006.5FastGPT is a knowledge-based platform built on the LLMs. Since the web crawling plug-in does not perform intranet IP verification, an attack CVE-2025-276014.3Umbraco is a free and open source .NET content management system. An improper API access control issue has been identified Umbraco's API man CVE-2025-276026.4Umbraco is a free and open source .NET content management system. In versions of Umbraco's web backoffice program prior to versions 10.8.9 a CVE-2025-276039.1XWiki Confluence Migrator Pro helps admins to import confluence packages into their XWiki instance. A user that doesn't have programming rig CVE-2025-276047.5XWiki Confluence Migrator Pro helps admins to import confluence packages into their XWiki instance. The homepage of the application is publi CVE-2025-276064.6Element Android is an Android Matrix Client provided by Element. Element Android up to version 1.6.32 can, under certain circumstances, fail CVE-2025-276078.8Python JSON Logger is a JSON Formatter for Python Logging. Between 30 December 2024 and 4 March 2025 Python JSON Logger was vulnerable to RC CVE-2025-276081.0Arduino IDE 2.x is an IDE based on the Theia IDE framework and built with Electron. A Self Cross-Site Scripting (XSS) vulnerability has been CVE-2025-276095.4Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 a CVE-2025-27617.8GIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitra