CVE-2025-7345
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk60th percentile - higher than 60% of all known CVEs
Summary
A heap buffer overflow vulnerability has been discovered in the gdk-pixbuf and glib libraries when processing maliciously crafted JPEG images. The flaw resides in the gdk_pixbuf__jpeg_image_load_increment and g_base64_encode_step functions, potentially allowing out-of-bounds reads from heap memory.
Risk Assessment
An attacker could exploit this vulnerability to cause application crashes or potentially execute arbitrary code within the context of the image-processing process, posing a significant security risk.
Recommendation
Immediately update the gdk-pixbuf and glib libraries to the latest patched version. Until the update is applied, avoid processing untrusted JPEG images.
Other vulnerabilities in gdk-pixbuf
See all- CVE-2017-2870High
An exploitable integer overflow vulnerability exists in the tiff_image_parse functionality of Gdk-Pixbuf 2.36.6 when compiled with Clang. A specially crafted tiff file can cause a heap-overflow resulting in remote code execution.
- CVE-2017-2862High
A heap overflow vulnerability exists in the gdk_pixbuf__jpeg_image_load_increment functionality of Gdk-Pixbuf 2.36.6. A specially crafted jpeg file can cause a heap overflow resulting in remote code execution.
- CVE-2017-6313High
An integer underflow in the load_resources function in io-icns.c in gdk-pixbuf can be exploited by context-dependent attackers to cause a denial of service through a crafted image entry size in an ICO file.
- CVE-2017-6311High
The gdk-pixbuf-thumbnailer.c file in gdk-pixbuf contains a vulnerability that allows context-dependent attackers to cause a denial of service through a NULL pointer dereference, leading to application crashes.
- CVE-2016-6352High
The OneLine32 function in io-ico.c in gdk-pixbuf before version 2.35.3 allows remote attackers to cause a denial of service (out-of-bounds write and crash) via crafted dimensions in an ICO file.
- CVE-2015-8875High
Multiple integer overflows in the pixops_composite_nearest, pixops_composite_color_nearest, and pixops_process functions in gdk-pixbuf before version 2.33.1 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted image.
- CVE-2015-7552High
Heap-based buffer overflow in the gdk_pixbuf_flip function in gdk-pixbuf-scale.c in gdk-pixbuf 2.30.x allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted BMP file.
- CVE-2026-81893Medium
A flaw was found in gdk-pixbuf. When loading a specially crafted JPEG image containing chunked ICC profile markers, an error during ICC profile parsing can leave stale size metadata after the profile buffer is freed. A subsequent allocation in the same decode can cause an out-of-bounds write, potentially crashing the application. To exploit this flaw, an application using gdk-pixbuf must process the malicious JPEG image. Affected version >= 2.26.4.
- CVE-2026-16768Medium
An out-of-bounds read vulnerability was found in the gdk-pixbuf library when parsing a specially crafted ICO file with pixel values exceeding the defined palette range. An attacker can extract heap content via the generated output, such as a thumbnail.
- CVE-2026-5201High
A heap-based buffer overflow vulnerability was found in the gdk-pixbuf library's JPEG image loader due to improper validation of color component counts when processing a specially crafted JPEG image. A remote attacker can exploit this flaw without user interaction, for example, via thumbnail generation, leading to application crashes and denial of service (DoS).
Original NVD description (English source)
A flaw exists in gdk‑pixbuf within the gdk_pixbuf__jpeg_image_load_increment function (io-jpeg.c) and in glib’s g_base64_encode_step (glib/gbase64.c). When processing maliciously crafted JPEG images, a heap buffer overflow can occur during Base64 encoding, allowing out-of-bounds reads from heap memory, potentially causing application crashes or arbitrary code execution.