CVE-2025-6199

LowCVSS 3.3/10Last modified Jun 30, 2026

Description

A flaw was found in the GIF parser of GdkPixbuf’s LZW decoder. When an invalid symbol is encountered during decompression, the decoder sets the reported output size to the full buffer length rather than the actual number of written bytes. This logic error results in uninitialized sections of the buffer being included in the output, potentially leaking arbitrary memory contents in the processed image.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Jun 17, 2025
Last modified: Jun 30, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-619907.5When using a multi-bladed platform with more than one blade, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to termi CVE-2025-619944.8Cross-site scripting vulnerability exists in GROWI prior to v7.2.10. If a malicious user creates a page containing crafted contents, an arbi CVE-2025-619964.8OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to inject JavaScript or other content within the Annual Report Template. In CVE-2025-619974.8OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to inject JavaScript or other content within the Annual Report Enterprise B CVE-2025-619984.8OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to inject JavaScript or other content as a URL within the Technical Support CVE-2025-619994.8OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to upload JavaScript or other content embedded in an SVG image used as a lo CVE-2025-62005.9The GeoDirectory WordPress plugin before 2.8.120 does not validate and escape some of its shortcode attributes before outputting them back CVE-2025-620007.1BullWall Ransomware Containment may not always detect an encrypted file. This issue affects a specific file inspection method that evaluates CVE-2025-620018.8BullWall Ransomware Containment supports configurable file and directory exclusions such as '$RECYCLE.BIN' to balance monitoring scope and p CVE-2025-620028.1BullWall Ransomware Containment considers the number of files modified to trigger detection. An authenticated attacker could encrypt a singl CVE-2025-620037.5BullWall Server Intrusion Protection has a noticeable configuration-dependent delay before the MFA check for RDP connections. A remote, auth CVE-2025-620047.5BullWall Server Intrusion Protection (SIP) services are initialized after login services during system startup. A local, authenticated attac