Gdk-pixbuf: uninitialized memory disclosure in gdkpixbuf gif lzw decoder
CVE-2025-6199 is fixed in 16 products on 1 platform, first by DEBIAN-CVE-2025-6199, released June 17, 2025. It is not reported as exploited. Patch Radar priority: Routine.
A flaw was found in the GIF parser of GdkPixbuf’s LZW decoder. When aninvalid symbol is encountered during decompression, the decoder sets thereported output size to the full buffer length rather than the actualnumber of written bytes. This logic error results in uninitialized sectionsof the buffer being included in the output, potentially leaking arbitrarymemory contents in the processed image.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| gdk-pixbuf · Debian 11.6 (bullseye) | 2.42.2+dfsg-1+deb11u3 | DLA-4225-1 | Jun 23, 2025 |
| gdk-pixbuf · Debian 12.15 (bookworm) | 2.42.10+dfsg-1+deb12u2 | DSA-5946-1 | Jun 22, 2025 |
| gdk-pixbuf · Debian 13.5 (trixie) | 2.42.12+dfsg-3 | DEBIAN-CVE-2025-6199 | Jun 17, 2025 |
| gdk-pixbuf · Debian 14 | 2.42.12+dfsg-3 | DEBIAN-CVE-2025-6199 | Jun 17, 2025 |
| gdk-pixbuf · opensuse-leap 15.6 | 2.42.12-150600.3.8.1 | SUSE-SU-2025:02954-1 | Aug 21, 2025 |
| gdk-pixbuf · opensuse-leap 16.0 | 2.42.12-160000.3.1 | OPENSUSE-SU-2026:20084-1 | Jan 22, 2026 |
| gdk-pixbuf · sles 15.6 | 2.42.12-150600.3.8.1 | SUSE-SU-2025:02954-1 | Aug 21, 2025 |
| gdk-pixbuf · sles 15.7 | 2.42.12-150600.3.8.1 | SUSE-SU-2025:02954-1 | Aug 21, 2025 |
| gdk-pixbuf · sles 16.0 | 2.42.12-160000.3.1 | SUSE-SU-2026:20128-1 | Jan 22, 2026 |
| gdk-pixbuf-tests · Ubuntu 22.04.1 LTS (jammy) | 2.42.8+dfsg-1ubuntu0.4 | gdk-pixbuf-tests 2.42.8+dfsg-1ubuntu0.4 | Jul 8, 2025 |
| gdk-pixbuf-tests · Ubuntu 24.04.5 LTS (noble) | 2.42.10+dfsg-3ubuntu3.2 | gdk-pixbuf-tests 2.42.10+dfsg-3ubuntu3.2 | Jul 8, 2025 |
| gdk-pixbuf-tests · Ubuntu 25.04 (plucky) | 2.42.12+dfsg-2ubuntu0.1 | gdk-pixbuf-tests 2.42.12+dfsg-2ubuntu0.1 | Jan 16, 2026 |
| gdk-pixbuf-tests · Ubuntu 25.10 (questing) | 2.42.12+dfsg-4build1 | gdk-pixbuf-tests 2.42.12+dfsg-4build1 | Jul 8, 2025 |
| gdk-pixbuf2 · amzn 2023 | 2.42.12-185.amzn2023 | ALAS2023-2026-1553 | Apr 13, 2026 |
| gdk-pixbuf2-debuginfo · amzn 2023 | 2.42.12-185.amzn2023 | ALAS2023-2026-1553 | Apr 13, 2026 |
| gdk-pixbuf2-debugsource · amzn 2023 | 2.42.12-185.amzn2023 | ALAS2023-2026-1553 | Apr 13, 2026 |
| gdk-pixbuf2-devel · amzn 2023 | 2.42.12-185.amzn2023 | ALAS2023-2026-1553 | Apr 13, 2026 |
| gdk-pixbuf2-devel-debuginfo · amzn 2023 | 2.42.12-185.amzn2023 | ALAS2023-2026-1553 | Apr 13, 2026 |
| gdk-pixbuf2-modules · amzn 2023 | 2.42.12-185.amzn2023 | ALAS2023-2026-1553 | Apr 13, 2026 |
| gdk-pixbuf2-modules-debuginfo · amzn 2023 | 2.42.12-185.amzn2023 | ALAS2023-2026-1553 | Apr 13, 2026 |
| gdk-pixbuf2-tests · amzn 2023 | 2.42.12-185.amzn2023 | ALAS2023-2026-1553 | Apr 13, 2026 |
| gdk-pixbuf2-tests-debuginfo · amzn 2023 | 2.42.12-185.amzn2023 | ALAS2023-2026-1553 | Apr 13, 2026 |
| gir1.2-gdkpixbuf-2.0 · Ubuntu 18.04.6 LTS (bionic) | 2.36.11-2ubuntu0.1~esm2 | gir1.2-gdkpixbuf-2.0 2.36.11-2ubuntu0.1~esm2 | Jul 8, 2025 |
| gir1.2-gdkpixbuf-2.0 · Ubuntu 20.04 LTS (focal) | 2.40.0+dfsg-3ubuntu0.5+esm1 | gir1.2-gdkpixbuf-2.0 2.40.0+dfsg-3ubuntu0.5+esm1 | Jul 8, 2025 |
| gir1.2-gdkpixbuf-2.0 · Ubuntu 22.04.1 LTS (jammy) | 2.42.8+dfsg-1ubuntu0.4 | gir1.2-gdkpixbuf-2.0 2.42.8+dfsg-1ubuntu0.4 | Jul 8, 2025 |
| gir1.2-gdkpixbuf-2.0 · Ubuntu 24.04.5 LTS (noble) | 2.42.10+dfsg-3ubuntu3.2 | gir1.2-gdkpixbuf-2.0 2.42.10+dfsg-3ubuntu3.2 | Jul 8, 2025 |
| gir1.2-gdkpixbuf-2.0 · Ubuntu 25.04 (plucky) | 2.42.12+dfsg-2ubuntu0.1 | gir1.2-gdkpixbuf-2.0 2.42.12+dfsg-2ubuntu0.1 | Jan 16, 2026 |
| gir1.2-gdkpixbuf-2.0 · Ubuntu 25.10 (questing) | 2.42.12+dfsg-4build1 | gir1.2-gdkpixbuf-2.0 2.42.12+dfsg-4build1 | Jul 8, 2025 |
| libgdk-pixbuf-2.0-0 · Ubuntu 22.04.1 LTS (jammy) | 2.42.8+dfsg-1ubuntu0.4 | libgdk-pixbuf-2.0-0 2.42.8+dfsg-1ubuntu0.4 | Jul 8, 2025 |
| libgdk-pixbuf-2.0-0 · Ubuntu 24.04.5 LTS (noble) | 2.42.10+dfsg-3ubuntu3.2 | libgdk-pixbuf-2.0-0 2.42.10+dfsg-3ubuntu3.2 | Jul 8, 2025 |
| libgdk-pixbuf-2.0-0 · Ubuntu 25.04 (plucky) | 2.42.12+dfsg-2ubuntu0.1 | libgdk-pixbuf-2.0-0 2.42.12+dfsg-2ubuntu0.1 | Jan 16, 2026 |
| libgdk-pixbuf-2.0-0 · Ubuntu 25.10 (questing) | 2.42.12+dfsg-4build1 | libgdk-pixbuf-2.0-0 2.42.12+dfsg-4build1 | Jul 8, 2025 |
| libgdk-pixbuf2.0-0 · Ubuntu 18.04.6 LTS (bionic) | 2.36.11-2ubuntu0.1~esm2 | libgdk-pixbuf2.0-0 2.36.11-2ubuntu0.1~esm2 | Jul 8, 2025 |
| libgdk-pixbuf2.0-0 · Ubuntu 20.04 LTS (focal) | 2.40.0+dfsg-3ubuntu0.5+esm1 | libgdk-pixbuf2.0-0 2.40.0+dfsg-3ubuntu0.5+esm1 | Jul 8, 2025 |
| libgdk-pixbuf2.0-bin · Ubuntu 18.04.6 LTS (bionic) | 2.36.11-2ubuntu0.1~esm2 | libgdk-pixbuf2.0-bin 2.36.11-2ubuntu0.1~esm2 | Jul 8, 2025 |
| libgdk-pixbuf2.0-bin · Ubuntu 20.04 LTS (focal) | 2.40.0+dfsg-3ubuntu0.5+esm1 | libgdk-pixbuf2.0-bin 2.40.0+dfsg-3ubuntu0.5+esm1 | Jul 8, 2025 |
| libgdk-pixbuf2.0-bin · Ubuntu 22.04.1 LTS (jammy) | 2.42.8+dfsg-1ubuntu0.4 | libgdk-pixbuf2.0-bin 2.42.8+dfsg-1ubuntu0.4 | Jul 8, 2025 |
| libgdk-pixbuf2.0-bin · Ubuntu 24.04.5 LTS (noble) | 2.42.10+dfsg-3ubuntu3.2 | libgdk-pixbuf2.0-bin 2.42.10+dfsg-3ubuntu3.2 | Jul 8, 2025 |
| libgdk-pixbuf2.0-bin · Ubuntu 25.04 (plucky) | 2.42.12+dfsg-2ubuntu0.1 | libgdk-pixbuf2.0-bin 2.42.12+dfsg-2ubuntu0.1 | Jan 16, 2026 |
| libgdk-pixbuf2.0-bin · Ubuntu 25.10 (questing) | 2.42.12+dfsg-4build1 | libgdk-pixbuf2.0-bin 2.42.12+dfsg-4build1 | Jul 8, 2025 |
| libgdk-pixbuf2.0-common · Ubuntu 18.04.6 LTS (bionic) | 2.36.11-2ubuntu0.1~esm2 | libgdk-pixbuf2.0-common 2.36.11-2ubuntu0.1~esm2 | Jul 8, 2025 |
| libgdk-pixbuf2.0-common · Ubuntu 20.04 LTS (focal) | 2.40.0+dfsg-3ubuntu0.5+esm1 | libgdk-pixbuf2.0-common 2.40.0+dfsg-3ubuntu0.5+esm1 | Jul 8, 2025 |
| libgdk-pixbuf2.0-common · Ubuntu 22.04.1 LTS (jammy) | 2.42.8+dfsg-1ubuntu0.4 | libgdk-pixbuf2.0-common 2.42.8+dfsg-1ubuntu0.4 | Jul 8, 2025 |
| libgdk-pixbuf2.0-common · Ubuntu 24.04.5 LTS (noble) | 2.42.10+dfsg-3ubuntu3.2 | libgdk-pixbuf2.0-common 2.42.10+dfsg-3ubuntu3.2 | Jul 8, 2025 |
| libgdk-pixbuf2.0-common · Ubuntu 25.04 (plucky) | 2.42.12+dfsg-2ubuntu0.1 | libgdk-pixbuf2.0-common 2.42.12+dfsg-2ubuntu0.1 | Jan 16, 2026 |
| libgdk-pixbuf2.0-common · Ubuntu 25.10 (questing) | 2.42.12+dfsg-4build1 | libgdk-pixbuf2.0-common 2.42.12+dfsg-4build1 | Jul 8, 2025 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.