Vulnerability-Lookup

OESA-2025-1913 (CVE-2025-7345)

Vulnerability from osv_openeuler – Published: 2025-07-25 11:09 – Updated: 2026-08-06 11:09 – Source website

Summary

gdk-pixbuf2 security update

Details

gdk is written in C but has been designed from the ground up to support a wide range of languages. It provide a complete set of widgets,and suitable for projects ranging from small one-off tools to complete application suites.

Security Fix(es):

A vulnerability was found in gdk‑pixbuf (affected version not known). It has been rated as critical.Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().Impacted is confidentiality, integrity, and availability.There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.(CVE-2025-7345)

Severity

7.5 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-7345	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "gdk-pixbuf2-2.42.10-6.oe2403sp2.aarch64.rpm",
          "gdk-pixbuf2-debuginfo-2.42.10-6.oe2403sp2.aarch64.rpm",
          "gdk-pixbuf2-debugsource-2.42.10-6.oe2403sp2.aarch64.rpm",
          "gdk-pixbuf2-devel-2.42.10-6.oe2403sp2.aarch64.rpm",
          "gdk-pixbuf2-modules-2.42.10-6.oe2403sp2.aarch64.rpm",
          "gdk-pixbuf2-tests-2.42.10-6.oe2403sp2.aarch64.rpm"
        ],
        "noarch": [
          "gdk-pixbuf2-help-2.42.10-6.oe2403sp2.noarch.rpm"
        ],
        "src": [
          "gdk-pixbuf2-2.42.10-6.oe2403sp2.src.rpm"
        ],
        "x86_64": [
          "gdk-pixbuf2-2.42.10-6.oe2403sp2.x86_64.rpm",
          "gdk-pixbuf2-debuginfo-2.42.10-6.oe2403sp2.x86_64.rpm",
          "gdk-pixbuf2-debugsource-2.42.10-6.oe2403sp2.x86_64.rpm",
          "gdk-pixbuf2-devel-2.42.10-6.oe2403sp2.x86_64.rpm",
          "gdk-pixbuf2-modules-2.42.10-6.oe2403sp2.x86_64.rpm",
          "gdk-pixbuf2-tests-2.42.10-6.oe2403sp2.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP2",
        "name": "gdk-pixbuf2",
        "purl": "pkg:rpm/openEuler/gdk-pixbuf2\u0026distro=openEuler-24.03-LTS-SP2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.42.10-6.oe2403sp2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "gdk-pixbuf2-2.40.0-8.oe2003sp4.aarch64.rpm",
          "gdk-pixbuf2-debuginfo-2.40.0-8.oe2003sp4.aarch64.rpm",
          "gdk-pixbuf2-debugsource-2.40.0-8.oe2003sp4.aarch64.rpm",
          "gdk-pixbuf2-devel-2.40.0-8.oe2003sp4.aarch64.rpm"
        ],
        "noarch": [
          "gdk-pixbuf2-help-2.40.0-8.oe2003sp4.noarch.rpm"
        ],
        "src": [
          "gdk-pixbuf2-2.40.0-8.oe2003sp4.src.rpm"
        ],
        "x86_64": [
          "gdk-pixbuf2-2.40.0-8.oe2003sp4.x86_64.rpm",
          "gdk-pixbuf2-debuginfo-2.40.0-8.oe2003sp4.x86_64.rpm",
          "gdk-pixbuf2-debugsource-2.40.0-8.oe2003sp4.x86_64.rpm",
          "gdk-pixbuf2-devel-2.40.0-8.oe2003sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:20.03-LTS-SP4",
        "name": "gdk-pixbuf2",
        "purl": "pkg:rpm/openEuler/gdk-pixbuf2\u0026distro=openEuler-20.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.40.0-8.oe2003sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "gdk-pixbuf2-2.42.6-9.oe2203sp3.aarch64.rpm",
          "gdk-pixbuf2-debuginfo-2.42.6-9.oe2203sp3.aarch64.rpm",
          "gdk-pixbuf2-debugsource-2.42.6-9.oe2203sp3.aarch64.rpm",
          "gdk-pixbuf2-devel-2.42.6-9.oe2203sp3.aarch64.rpm",
          "gdk-pixbuf2-modules-2.42.6-9.oe2203sp3.aarch64.rpm",
          "gdk-pixbuf2-tests-2.42.6-9.oe2203sp3.aarch64.rpm"
        ],
        "noarch": [
          "gdk-pixbuf2-help-2.42.6-9.oe2203sp3.noarch.rpm"
        ],
        "src": [
          "gdk-pixbuf2-2.42.6-9.oe2203sp3.src.rpm"
        ],
        "x86_64": [
          "gdk-pixbuf2-2.42.6-9.oe2203sp3.x86_64.rpm",
          "gdk-pixbuf2-debuginfo-2.42.6-9.oe2203sp3.x86_64.rpm",
          "gdk-pixbuf2-debugsource-2.42.6-9.oe2203sp3.x86_64.rpm",
          "gdk-pixbuf2-devel-2.42.6-9.oe2203sp3.x86_64.rpm",
          "gdk-pixbuf2-modules-2.42.6-9.oe2203sp3.x86_64.rpm",
          "gdk-pixbuf2-tests-2.42.6-9.oe2203sp3.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS-SP3",
        "name": "gdk-pixbuf2",
        "purl": "pkg:rpm/openEuler/gdk-pixbuf2\u0026distro=openEuler-22.03-LTS-SP3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.42.6-9.oe2203sp3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "gdk-pixbuf2-2.42.6-9.oe2203sp4.aarch64.rpm",
          "gdk-pixbuf2-debuginfo-2.42.6-9.oe2203sp4.aarch64.rpm",
          "gdk-pixbuf2-debugsource-2.42.6-9.oe2203sp4.aarch64.rpm",
          "gdk-pixbuf2-devel-2.42.6-9.oe2203sp4.aarch64.rpm",
          "gdk-pixbuf2-modules-2.42.6-9.oe2203sp4.aarch64.rpm",
          "gdk-pixbuf2-tests-2.42.6-9.oe2203sp4.aarch64.rpm"
        ],
        "noarch": [
          "gdk-pixbuf2-help-2.42.6-9.oe2203sp4.noarch.rpm"
        ],
        "src": [
          "gdk-pixbuf2-2.42.6-9.oe2203sp4.src.rpm"
        ],
        "x86_64": [
          "gdk-pixbuf2-2.42.6-9.oe2203sp4.x86_64.rpm",
          "gdk-pixbuf2-debuginfo-2.42.6-9.oe2203sp4.x86_64.rpm",
          "gdk-pixbuf2-debugsource-2.42.6-9.oe2203sp4.x86_64.rpm",
          "gdk-pixbuf2-devel-2.42.6-9.oe2203sp4.x86_64.rpm",
          "gdk-pixbuf2-modules-2.42.6-9.oe2203sp4.x86_64.rpm",
          "gdk-pixbuf2-tests-2.42.6-9.oe2203sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS-SP4",
        "name": "gdk-pixbuf2",
        "purl": "pkg:rpm/openEuler/gdk-pixbuf2\u0026distro=openEuler-22.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.42.6-9.oe2203sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "gdk-pixbuf2-2.42.10-6.oe2403sp2.aarch64.rpm",
          "gdk-pixbuf2-debuginfo-2.42.10-6.oe2403sp2.aarch64.rpm",
          "gdk-pixbuf2-debugsource-2.42.10-6.oe2403sp2.aarch64.rpm",
          "gdk-pixbuf2-devel-2.42.10-6.oe2403sp2.aarch64.rpm",
          "gdk-pixbuf2-modules-2.42.10-6.oe2403sp2.aarch64.rpm",
          "gdk-pixbuf2-tests-2.42.10-6.oe2403sp2.aarch64.rpm",
          "gdk-pixbuf2-2.42.10-6.oe2403.aarch64.rpm",
          "gdk-pixbuf2-debuginfo-2.42.10-6.oe2403.aarch64.rpm",
          "gdk-pixbuf2-debugsource-2.42.10-6.oe2403.aarch64.rpm",
          "gdk-pixbuf2-devel-2.42.10-6.oe2403.aarch64.rpm",
          "gdk-pixbuf2-modules-2.42.10-6.oe2403.aarch64.rpm",
          "gdk-pixbuf2-tests-2.42.10-6.oe2403.aarch64.rpm",
          "gdk-pixbuf2-2.42.10-6.oe2403sp1.aarch64.rpm",
          "gdk-pixbuf2-debuginfo-2.42.10-6.oe2403sp1.aarch64.rpm",
          "gdk-pixbuf2-debugsource-2.42.10-6.oe2403sp1.aarch64.rpm",
          "gdk-pixbuf2-devel-2.42.10-6.oe2403sp1.aarch64.rpm",
          "gdk-pixbuf2-modules-2.42.10-6.oe2403sp1.aarch64.rpm",
          "gdk-pixbuf2-tests-2.42.10-6.oe2403sp1.aarch64.rpm"
        ],
        "noarch": [
          "gdk-pixbuf2-help-2.42.10-6.oe2403sp2.noarch.rpm",
          "gdk-pixbuf2-help-2.42.10-6.oe2403.noarch.rpm",
          "gdk-pixbuf2-help-2.42.10-6.oe2403sp1.noarch.rpm"
        ],
        "src": [
          "gdk-pixbuf2-2.42.10-6.oe2403sp2.src.rpm",
          "gdk-pixbuf2-2.42.10-6.oe2403.src.rpm",
          "gdk-pixbuf2-2.42.10-6.oe2403sp1.src.rpm"
        ],
        "x86_64": [
          "gdk-pixbuf2-2.42.10-6.oe2403sp2.x86_64.rpm",
          "gdk-pixbuf2-debuginfo-2.42.10-6.oe2403sp2.x86_64.rpm",
          "gdk-pixbuf2-debugsource-2.42.10-6.oe2403sp2.x86_64.rpm",
          "gdk-pixbuf2-devel-2.42.10-6.oe2403sp2.x86_64.rpm",
          "gdk-pixbuf2-modules-2.42.10-6.oe2403sp2.x86_64.rpm",
          "gdk-pixbuf2-tests-2.42.10-6.oe2403sp2.x86_64.rpm",
          "gdk-pixbuf2-2.42.10-6.oe2403.x86_64.rpm",
          "gdk-pixbuf2-debuginfo-2.42.10-6.oe2403.x86_64.rpm",
          "gdk-pixbuf2-debugsource-2.42.10-6.oe2403.x86_64.rpm",
          "gdk-pixbuf2-devel-2.42.10-6.oe2403.x86_64.rpm",
          "gdk-pixbuf2-modules-2.42.10-6.oe2403.x86_64.rpm",
          "gdk-pixbuf2-tests-2.42.10-6.oe2403.x86_64.rpm",
          "gdk-pixbuf2-2.42.10-6.oe2403sp1.x86_64.rpm",
          "gdk-pixbuf2-debuginfo-2.42.10-6.oe2403sp1.x86_64.rpm",
          "gdk-pixbuf2-debugsource-2.42.10-6.oe2403sp1.x86_64.rpm",
          "gdk-pixbuf2-devel-2.42.10-6.oe2403sp1.x86_64.rpm",
          "gdk-pixbuf2-modules-2.42.10-6.oe2403sp1.x86_64.rpm",
          "gdk-pixbuf2-tests-2.42.10-6.oe2403sp1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS",
        "name": "gdk-pixbuf2",
        "purl": "pkg:rpm/openEuler/gdk-pixbuf2\u0026distro=openEuler-24.03-LTS"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.42.10-6.oe2403sp1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "gdk-pixbuf2-2.42.10-6.oe2403sp1.aarch64.rpm",
          "gdk-pixbuf2-debuginfo-2.42.10-6.oe2403sp1.aarch64.rpm",
          "gdk-pixbuf2-debugsource-2.42.10-6.oe2403sp1.aarch64.rpm",
          "gdk-pixbuf2-devel-2.42.10-6.oe2403sp1.aarch64.rpm",
          "gdk-pixbuf2-modules-2.42.10-6.oe2403sp1.aarch64.rpm",
          "gdk-pixbuf2-tests-2.42.10-6.oe2403sp1.aarch64.rpm"
        ],
        "noarch": [
          "gdk-pixbuf2-help-2.42.10-6.oe2403sp1.noarch.rpm"
        ],
        "src": [
          "gdk-pixbuf2-2.42.10-6.oe2403sp1.src.rpm"
        ],
        "x86_64": [
          "gdk-pixbuf2-2.42.10-6.oe2403sp1.x86_64.rpm",
          "gdk-pixbuf2-debuginfo-2.42.10-6.oe2403sp1.x86_64.rpm",
          "gdk-pixbuf2-debugsource-2.42.10-6.oe2403sp1.x86_64.rpm",
          "gdk-pixbuf2-devel-2.42.10-6.oe2403sp1.x86_64.rpm",
          "gdk-pixbuf2-modules-2.42.10-6.oe2403sp1.x86_64.rpm",
          "gdk-pixbuf2-tests-2.42.10-6.oe2403sp1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP1",
        "name": "gdk-pixbuf2",
        "purl": "pkg:rpm/openEuler/gdk-pixbuf2\u0026distro=openEuler-24.03-LTS-SP1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.42.10-6.oe2403sp1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "gdk is written in C but has been designed from the ground up to support a wide range of languages. It provide a complete set of widgets,and suitable for projects ranging from small one-off tools to complete application suites.\r\n\r\nSecurity Fix(es):\n\nA vulnerability was found in gdk\u2011pixbuf (affected version not known). It has been rated as critical.Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().Impacted is confidentiality, integrity, and availability.There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.(CVE-2025-7345)",
  "id": "OESA-2025-1913",
  "modified": "2026-08-06T11:09:00Z",
  "published": "2025-07-25T11:09:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1913"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7345"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "gdk-pixbuf2 security update",
  "upstream": [
    "CVE-2025-7345"
  ]
}

CVE-2025-7345 (GCVE-0-2025-7345)

Vulnerability from cvelistv5 – Published: 2025-07-08 13:39 – Updated: 2026-06-30 01:49

Title

Gdk‑pixbuf: heap‑buffer‑overflow in gdk‑pixbuf

Summary

A flaw exists in gdk‑pixbuf within the gdk_pixbuf__jpeg_image_load_increment function (io-jpeg.c) and in glib’s g_base64_encode_step (glib/gbase64.c). When processing maliciously crafted JPEG images, a heap buffer overflow can occur during Base64 encoding, allowing out-of-bounds reads from heap memory, potentially causing application crashes or arbitrary code execution.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-07-08 13:53 UTC

CWE

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Assigner

redhat redhat root

References

15 references

URL	Tags
https://access.redhat.com/errata/RHSA-2025:12841	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:12862	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:13315	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:14574	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:14575	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:14576	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:14585	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:14618	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:14646	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:14647	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:14683	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2025-7345	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2377063	issue-trackingx_refsource_REDHAT
https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/249
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

17 products

Vendor	Product	Version
		Affected: 0 , < 2.43.4 (semver)
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:2.42.12-4.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.0
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:2.36.12-4.el7_9 , < * (rpm) cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:2.36.12-7.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream cpe:/a:redhat:enterprise_linux:8::crb cpe:/o:redhat:enterprise_linux:8::baseos
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support	Unaffected: 0:2.36.12-6.el8_2 , < * (rpm) cpe:/a:redhat:rhel_aus:8.2::appstream cpe:/o:redhat:rhel_aus:8.2::baseos
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 0:2.36.12-6.el8_4 , < * (rpm) cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_eus_long_life:8.4::appstream cpe:/o:redhat:rhel_aus:8.4::baseos cpe:/o:redhat:rhel_eus_long_life:8.4::baseos
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	Unaffected: 0:2.36.12-6.el8_4 , < * (rpm) cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_eus_long_life:8.4::appstream cpe:/o:redhat:rhel_aus:8.4::baseos cpe:/o:redhat:rhel_eus_long_life:8.4::baseos
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 0:2.36.12-6.el8_6 , < * (rpm) cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_e4s:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream cpe:/o:redhat:rhel_aus:8.6::baseos cpe:/o:redhat:rhel_e4s:8.6::baseos cpe:/o:redhat:rhel_tus:8.6::baseos
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	Unaffected: 0:2.36.12-6.el8_6 , < * (rpm) cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_e4s:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream cpe:/o:redhat:rhel_aus:8.6::baseos cpe:/o:redhat:rhel_e4s:8.6::baseos cpe:/o:redhat:rhel_tus:8.6::baseos
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	Unaffected: 0:2.36.12-6.el8_6 , < * (rpm) cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_e4s:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream cpe:/o:redhat:rhel_aus:8.6::baseos cpe:/o:redhat:rhel_e4s:8.6::baseos cpe:/o:redhat:rhel_tus:8.6::baseos
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 0:2.36.12-6.el8_8 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.8::appstream cpe:/a:redhat:rhel_tus:8.8::appstream cpe:/o:redhat:rhel_e4s:8.8::baseos cpe:/o:redhat:rhel_tus:8.8::baseos
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 0:2.36.12-6.el8_8 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.8::appstream cpe:/a:redhat:rhel_tus:8.8::appstream cpe:/o:redhat:rhel_e4s:8.8::baseos cpe:/o:redhat:rhel_tus:8.8::baseos
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:2.42.6-6.el9_6 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	Unaffected: 0:2.42.6-3.el9_0 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.0::appstream
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:2.42.6-4.el9_2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2::appstream
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	Unaffected: 0:2.42.6-5.el9_4 , < * (rpm) cpe:/a:redhat:rhel_eus:9.4::appstream
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6

Date Public

2025-07-08 00:00

Credits

Red Hat would like to thank Yifan Zhang (Programming Languages Lab, Peking University) for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-7345",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-08T13:53:14.454493Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-08T13:54:32.331Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:45:28.567Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00024.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://gitlab.gnome.org/GNOME/",
          "defaultStatus": "unaffected",
          "packageName": "gdk-pixbuf",
          "versions": [
            {
              "lessThan": "2.43.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10.0"
          ],
          "defaultStatus": "affected",
          "packageName": "gdk-pixbuf2",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.42.12-4.el10_0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_els:7"
          ],
          "defaultStatus": "affected",
          "packageName": "gdk-pixbuf2",
          "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.36.12-4.el7_9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/a:redhat:enterprise_linux:8::crb",
            "cpe:/o:redhat:enterprise_linux:8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "gdk-pixbuf2",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.36.12-7.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/a:redhat:enterprise_linux:8::crb",
            "cpe:/o:redhat:enterprise_linux:8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "gdk-pixbuf2",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.36.12-7.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.2::appstream",
            "cpe:/o:redhat:rhel_aus:8.2::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "gdk-pixbuf2",
          "product": "Red Hat Enterprise Linux 8.2 Advanced Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.36.12-6.el8_2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.4::appstream",
            "cpe:/a:redhat:rhel_eus_long_life:8.4::appstream",
            "cpe:/o:redhat:rhel_aus:8.4::baseos",
            "cpe:/o:redhat:rhel_eus_long_life:8.4::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "gdk-pixbuf2",
          "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.36.12-6.el8_4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.4::appstream",
            "cpe:/a:redhat:rhel_eus_long_life:8.4::appstream",
            "cpe:/o:redhat:rhel_aus:8.4::baseos",
            "cpe:/o:redhat:rhel_eus_long_life:8.4::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "gdk-pixbuf2",
          "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.36.12-6.el8_4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.6::appstream",
            "cpe:/a:redhat:rhel_e4s:8.6::appstream",
            "cpe:/a:redhat:rhel_tus:8.6::appstream",
            "cpe:/o:redhat:rhel_aus:8.6::baseos",
            "cpe:/o:redhat:rhel_e4s:8.6::baseos",
            "cpe:/o:redhat:rhel_tus:8.6::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "gdk-pixbuf2",
          "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.36.12-6.el8_6",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.6::appstream",
            "cpe:/a:redhat:rhel_e4s:8.6::appstream",
            "cpe:/a:redhat:rhel_tus:8.6::appstream",
            "cpe:/o:redhat:rhel_aus:8.6::baseos",
            "cpe:/o:redhat:rhel_e4s:8.6::baseos",
            "cpe:/o:redhat:rhel_tus:8.6::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "gdk-pixbuf2",
          "product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.36.12-6.el8_6",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.6::appstream",
            "cpe:/a:redhat:rhel_e4s:8.6::appstream",
            "cpe:/a:redhat:rhel_tus:8.6::appstream",
            "cpe:/o:redhat:rhel_aus:8.6::baseos",
            "cpe:/o:redhat:rhel_e4s:8.6::baseos",
            "cpe:/o:redhat:rhel_tus:8.6::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "gdk-pixbuf2",
          "product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.36.12-6.el8_6",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:8.8::appstream",
            "cpe:/a:redhat:rhel_tus:8.8::appstream",
            "cpe:/o:redhat:rhel_e4s:8.8::baseos",
            "cpe:/o:redhat:rhel_tus:8.8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "gdk-pixbuf2",
          "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.36.12-6.el8_8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:8.8::appstream",
            "cpe:/a:redhat:rhel_tus:8.8::appstream",
            "cpe:/o:redhat:rhel_e4s:8.8::baseos",
            "cpe:/o:redhat:rhel_tus:8.8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "gdk-pixbuf2",
          "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.36.12-6.el8_8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "gdk-pixbuf2",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.42.6-6.el9_6",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:9.0::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "gdk-pixbuf2",
          "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.42.6-3.el9_0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:9.2::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "gdk-pixbuf2",
          "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.42.6-4.el9_2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.4::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "gdk-pixbuf2",
          "product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.42.6-5.el9_4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "unknown",
          "packageName": "gdk-pixbuf2",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Yifan Zhang (Programming Languages Lab, Peking University) for reporting this issue."
        }
      ],
      "datePublic": "2025-07-08T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw exists in gdk\u2011pixbuf within the gdk_pixbuf__jpeg_image_load_increment function (io-jpeg.c) and in glib\u2019s g_base64_encode_step (glib/gbase64.c). When processing maliciously crafted JPEG images, a heap buffer overflow can occur during Base64 encoding, allowing out-of-bounds reads from heap memory, potentially causing application crashes or arbitrary code execution."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-120",
              "description": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-30T01:49:35.243Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2025:12841",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:12841"
        },
        {
          "name": "RHSA-2025:12862",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:12862"
        },
        {
          "name": "RHSA-2025:13315",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:13315"
        },
        {
          "name": "RHSA-2025:14574",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:14574"
        },
        {
          "name": "RHSA-2025:14575",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:14575"
        },
        {
          "name": "RHSA-2025:14576",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:14576"
        },
        {
          "name": "RHSA-2025:14585",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:14585"
        },
        {
          "name": "RHSA-2025:14618",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:14618"
        },
        {
          "name": "RHSA-2025:14646",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:14646"
        },
        {
          "name": "RHSA-2025:14647",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:14647"
        },
        {
          "name": "RHSA-2025:14683",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:14683"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2025-7345"
        },
        {
          "name": "RHBZ#2377063",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2377063"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/249"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-07-08T05:57:08.229Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2025-07-08T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Gdk\u2011pixbuf: heap\u2011buffer\u2011overflow in gdk\u2011pixbuf",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-120: Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2025-7345",
    "datePublished": "2025-07-08T13:39:07.949Z",
    "dateReserved": "2025-07-08T06:13:05.999Z",
    "dateUpdated": "2026-06-30T01:49:35.243Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.