CVE-2025-6199

Gdk-pixbuf: uninitialized memory disclosure in gdkpixbuf gif lzw decoder

CVE-2025-6199 is fixed in 16 products on 1 platform, first by DEBIAN-CVE-2025-6199, released June 17, 2025. It is not reported as exploited. Patch Radar priority: Routine.

Routine
CVSS
3.3
Low
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0021
10th percentile

A flaw was found in the GIF parser of GdkPixbuf’s LZW decoder. When aninvalid symbol is encountered during decompression, the decoder sets thereported output size to the full buffer length rather than the actualnumber of written bytes. This logic error results in uninitialized sectionsof the buffer being included in the output, potentially leaking arbitrarymemory contents in the processed image.

Where it's fixed

ProductFixed inFixReleased
Linux
gdk-pixbuf · Debian 11.6 (bullseye) 2.42.2+dfsg-1+deb11u3 DLA-4225-1 Jun 23, 2025
gdk-pixbuf · Debian 12.15 (bookworm) 2.42.10+dfsg-1+deb12u2 DSA-5946-1 Jun 22, 2025
gdk-pixbuf · Debian 13.5 (trixie) 2.42.12+dfsg-3 DEBIAN-CVE-2025-6199 Jun 17, 2025
gdk-pixbuf · Debian 14 2.42.12+dfsg-3 DEBIAN-CVE-2025-6199 Jun 17, 2025
gdk-pixbuf · opensuse-leap 15.6 2.42.12-150600.3.8.1 SUSE-SU-2025:02954-1 Aug 21, 2025
gdk-pixbuf · opensuse-leap 16.0 2.42.12-160000.3.1 OPENSUSE-SU-2026:20084-1 Jan 22, 2026
gdk-pixbuf · sles 15.6 2.42.12-150600.3.8.1 SUSE-SU-2025:02954-1 Aug 21, 2025
gdk-pixbuf · sles 15.7 2.42.12-150600.3.8.1 SUSE-SU-2025:02954-1 Aug 21, 2025
gdk-pixbuf · sles 16.0 2.42.12-160000.3.1 SUSE-SU-2026:20128-1 Jan 22, 2026
gdk-pixbuf-tests · Ubuntu 22.04.1 LTS (jammy) 2.42.8+dfsg-1ubuntu0.4 gdk-pixbuf-tests 2.42.8+dfsg-1ubuntu0.4 Jul 8, 2025
gdk-pixbuf-tests · Ubuntu 24.04.5 LTS (noble) 2.42.10+dfsg-3ubuntu3.2 gdk-pixbuf-tests 2.42.10+dfsg-3ubuntu3.2 Jul 8, 2025
gdk-pixbuf-tests · Ubuntu 25.04 (plucky) 2.42.12+dfsg-2ubuntu0.1 gdk-pixbuf-tests 2.42.12+dfsg-2ubuntu0.1 Jan 16, 2026
gdk-pixbuf-tests · Ubuntu 25.10 (questing) 2.42.12+dfsg-4build1 gdk-pixbuf-tests 2.42.12+dfsg-4build1 Jul 8, 2025
gdk-pixbuf2 · amzn 2023 2.42.12-185.amzn2023 ALAS2023-2026-1553 Apr 13, 2026
gdk-pixbuf2-debuginfo · amzn 2023 2.42.12-185.amzn2023 ALAS2023-2026-1553 Apr 13, 2026
gdk-pixbuf2-debugsource · amzn 2023 2.42.12-185.amzn2023 ALAS2023-2026-1553 Apr 13, 2026
gdk-pixbuf2-devel · amzn 2023 2.42.12-185.amzn2023 ALAS2023-2026-1553 Apr 13, 2026
gdk-pixbuf2-devel-debuginfo · amzn 2023 2.42.12-185.amzn2023 ALAS2023-2026-1553 Apr 13, 2026
gdk-pixbuf2-modules · amzn 2023 2.42.12-185.amzn2023 ALAS2023-2026-1553 Apr 13, 2026
gdk-pixbuf2-modules-debuginfo · amzn 2023 2.42.12-185.amzn2023 ALAS2023-2026-1553 Apr 13, 2026
gdk-pixbuf2-tests · amzn 2023 2.42.12-185.amzn2023 ALAS2023-2026-1553 Apr 13, 2026
gdk-pixbuf2-tests-debuginfo · amzn 2023 2.42.12-185.amzn2023 ALAS2023-2026-1553 Apr 13, 2026
gir1.2-gdkpixbuf-2.0 · Ubuntu 18.04.6 LTS (bionic) 2.36.11-2ubuntu0.1~esm2 gir1.2-gdkpixbuf-2.0 2.36.11-2ubuntu0.1~esm2 Jul 8, 2025
gir1.2-gdkpixbuf-2.0 · Ubuntu 20.04 LTS (focal) 2.40.0+dfsg-3ubuntu0.5+esm1 gir1.2-gdkpixbuf-2.0 2.40.0+dfsg-3ubuntu0.5+esm1 Jul 8, 2025
gir1.2-gdkpixbuf-2.0 · Ubuntu 22.04.1 LTS (jammy) 2.42.8+dfsg-1ubuntu0.4 gir1.2-gdkpixbuf-2.0 2.42.8+dfsg-1ubuntu0.4 Jul 8, 2025
gir1.2-gdkpixbuf-2.0 · Ubuntu 24.04.5 LTS (noble) 2.42.10+dfsg-3ubuntu3.2 gir1.2-gdkpixbuf-2.0 2.42.10+dfsg-3ubuntu3.2 Jul 8, 2025
gir1.2-gdkpixbuf-2.0 · Ubuntu 25.04 (plucky) 2.42.12+dfsg-2ubuntu0.1 gir1.2-gdkpixbuf-2.0 2.42.12+dfsg-2ubuntu0.1 Jan 16, 2026
gir1.2-gdkpixbuf-2.0 · Ubuntu 25.10 (questing) 2.42.12+dfsg-4build1 gir1.2-gdkpixbuf-2.0 2.42.12+dfsg-4build1 Jul 8, 2025
libgdk-pixbuf-2.0-0 · Ubuntu 22.04.1 LTS (jammy) 2.42.8+dfsg-1ubuntu0.4 libgdk-pixbuf-2.0-0 2.42.8+dfsg-1ubuntu0.4 Jul 8, 2025
libgdk-pixbuf-2.0-0 · Ubuntu 24.04.5 LTS (noble) 2.42.10+dfsg-3ubuntu3.2 libgdk-pixbuf-2.0-0 2.42.10+dfsg-3ubuntu3.2 Jul 8, 2025
libgdk-pixbuf-2.0-0 · Ubuntu 25.04 (plucky) 2.42.12+dfsg-2ubuntu0.1 libgdk-pixbuf-2.0-0 2.42.12+dfsg-2ubuntu0.1 Jan 16, 2026
libgdk-pixbuf-2.0-0 · Ubuntu 25.10 (questing) 2.42.12+dfsg-4build1 libgdk-pixbuf-2.0-0 2.42.12+dfsg-4build1 Jul 8, 2025
libgdk-pixbuf2.0-0 · Ubuntu 18.04.6 LTS (bionic) 2.36.11-2ubuntu0.1~esm2 libgdk-pixbuf2.0-0 2.36.11-2ubuntu0.1~esm2 Jul 8, 2025
libgdk-pixbuf2.0-0 · Ubuntu 20.04 LTS (focal) 2.40.0+dfsg-3ubuntu0.5+esm1 libgdk-pixbuf2.0-0 2.40.0+dfsg-3ubuntu0.5+esm1 Jul 8, 2025
libgdk-pixbuf2.0-bin · Ubuntu 18.04.6 LTS (bionic) 2.36.11-2ubuntu0.1~esm2 libgdk-pixbuf2.0-bin 2.36.11-2ubuntu0.1~esm2 Jul 8, 2025
libgdk-pixbuf2.0-bin · Ubuntu 20.04 LTS (focal) 2.40.0+dfsg-3ubuntu0.5+esm1 libgdk-pixbuf2.0-bin 2.40.0+dfsg-3ubuntu0.5+esm1 Jul 8, 2025
libgdk-pixbuf2.0-bin · Ubuntu 22.04.1 LTS (jammy) 2.42.8+dfsg-1ubuntu0.4 libgdk-pixbuf2.0-bin 2.42.8+dfsg-1ubuntu0.4 Jul 8, 2025
libgdk-pixbuf2.0-bin · Ubuntu 24.04.5 LTS (noble) 2.42.10+dfsg-3ubuntu3.2 libgdk-pixbuf2.0-bin 2.42.10+dfsg-3ubuntu3.2 Jul 8, 2025
libgdk-pixbuf2.0-bin · Ubuntu 25.04 (plucky) 2.42.12+dfsg-2ubuntu0.1 libgdk-pixbuf2.0-bin 2.42.12+dfsg-2ubuntu0.1 Jan 16, 2026
libgdk-pixbuf2.0-bin · Ubuntu 25.10 (questing) 2.42.12+dfsg-4build1 libgdk-pixbuf2.0-bin 2.42.12+dfsg-4build1 Jul 8, 2025
libgdk-pixbuf2.0-common · Ubuntu 18.04.6 LTS (bionic) 2.36.11-2ubuntu0.1~esm2 libgdk-pixbuf2.0-common 2.36.11-2ubuntu0.1~esm2 Jul 8, 2025
libgdk-pixbuf2.0-common · Ubuntu 20.04 LTS (focal) 2.40.0+dfsg-3ubuntu0.5+esm1 libgdk-pixbuf2.0-common 2.40.0+dfsg-3ubuntu0.5+esm1 Jul 8, 2025
libgdk-pixbuf2.0-common · Ubuntu 22.04.1 LTS (jammy) 2.42.8+dfsg-1ubuntu0.4 libgdk-pixbuf2.0-common 2.42.8+dfsg-1ubuntu0.4 Jul 8, 2025
libgdk-pixbuf2.0-common · Ubuntu 24.04.5 LTS (noble) 2.42.10+dfsg-3ubuntu3.2 libgdk-pixbuf2.0-common 2.42.10+dfsg-3ubuntu3.2 Jul 8, 2025
libgdk-pixbuf2.0-common · Ubuntu 25.04 (plucky) 2.42.12+dfsg-2ubuntu0.1 libgdk-pixbuf2.0-common 2.42.12+dfsg-2ubuntu0.1 Jan 16, 2026
libgdk-pixbuf2.0-common · Ubuntu 25.10 (questing) 2.42.12+dfsg-4build1 libgdk-pixbuf2.0-common 2.42.12+dfsg-4build1 Jul 8, 2025

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.