CVE catalog

CVE-2021-36083

kimageformats: CVE-2021-36083

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
0.95% · Oct 25, 2026

KDE KImageFormats 5.70.0 through 5.81.0 has a stack-based buffer overflow in XCFImageFormat::loadTileRLE.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiankimageformatstrixie5.116.0-1fixed
Debiankimageformatsbookworm5.103.0-2fixed
Ubuntukimageformats16.045.15.0-0ubuntu1vulnerable
Ubuntukimageformats16.045.18.0-0ubuntu1vulnerable
Ubuntukimageformats18.045.38.0-0ubuntu1vulnerable
Ubuntukimageformats18.045.40.0-0ubuntu1vulnerable
Ubuntukimageformats18.045.41.0-0ubuntu1vulnerable
Ubuntukimageformats18.045.42.0-0ubuntu1vulnerable
Ubuntukimageformats18.045.43.0-0ubuntu1vulnerable
Ubuntukimageformats18.045.44.0-0ubuntu1vulnerable
Ubuntukimageformats20.045.62.0-0ubuntu1vulnerable
Ubuntukimageformats20.045.64.0-0ubuntu1vulnerable
Ubuntukimageformats20.045.64.0-0ubuntu2vulnerable
Ubuntukimageformats20.045.65.0-0ubuntu1vulnerable
Ubuntukimageformats20.045.66.0-0ubuntu1vulnerable
Ubuntukimageformats20.045.67.0-0ubuntu1vulnerable
Ubuntukimageformats20.045.68.0-0ubuntu1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiankimageformatssourcetrixie5.78.0-5not yet assignedNot reported[990527]
Debiankimageformatssourcebookworm5.78.0-5not yet assignedNot reported[990527]

[Debian bug #990527]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [kimageformat-plugins]Fixed

    Source package: [kimageformats]

    Details (2)

    • 5.103.0-2 · amd64 · bookworm

      Fixed · Fixed: 5.78.0-5

      dsa · kimageformats · debian · bookworm; dsa · kimageformats · debian · 12

    • 5.103.0-2 · arm64 · bookworm

      Fixed · Fixed: 5.78.0-5

      dsa · kimageformats · debian · bookworm; dsa · kimageformats · debian · 12

[Debian 13 (Trixie)]

  • [kimageformat-plugins]Fixed

    Source package: [kimageformats]

    Details (2)

    • 5.116.0-1 · amd64 · trixie

      Fixed · Fixed: 5.78.0-5

      dsa · kimageformats · debian · 13

    • 5.116.0-1 · arm64 · trixie

      Fixed · Fixed: 5.78.0-5

      dsa · kimageformats · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]