CVE-2025-54575

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

ImageSharp is a 2D graphics library. In versions below 2.1.11 and 3.0.0 through 3.1.10, a specially crafted GIF file containing a malformed comment extension block (with a missing block terminator) can cause the ImageSharp GIF decoder to enter an infinite loop while attempting to skip the block. This leads to a denial of service. Applications processing untrusted GIF input should upgrade to a patched version. This issue is fixed in versions 2.1.11 and 3.1.11.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-400CWE-770

Affected software

No affected versions have been published.

Timeline

Published
Jul 30, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-545769.1OAuth2-Proxy is an open-source tool that can act as either a standalone reverse proxy or a middleware component integrated into existing revCVE-2025-545817.5vproxy is an HTTP/HTTPS/SOCKS5 proxy server. In versions 2.3.3 and below, untrusted data is extracted from the user-controlled HTTP Proxy-AuCVE-2025-545836.5GitProxy is an application that stands between developers and a Git remote endpoint (e.g., github.com). Versions 1.19.1 and below allow userCVE-2025-545845.7GitProxy is an application that stands between developers and a Git remote endpoint (e.g., github.com). In versions 1.19.1 and below, an attCVE-2025-545856.5GitProxy is an application that stands between developers and a Git remote endpoint. In versions 1.19.1 and below, attackers can exploit theCVE-2025-545866.5GitProxy is an application that stands between developers and a Git remote endpoint. In versions 1.19.1 and below, attackers can inject exCVE-2025-545887.5Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. Versions 1.34.0 through 1.3CVE-2025-545896.1Copyparty is a portable file server. In versions 1.18.6 and below, when accessing the recent uploads page at `/?ru`, users can filter the reCVE-2025-54598.8A user with specific node group editing permissions and a specially crafted class parameter could be used to execute commands as root on theCVE-2025-545906.9webfinger.js is a TypeScript-based WebFinger client that runs in both browsers and Node.js environments. In versions 2.8.0 and below, the loCVE-2025-545917.5FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below expose information about feeds and tags of default admin users, CVE-2025-545929.8FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below do not properly terminate the session during logout. After a use