CVE catalog

CVE-2025-7345

GDK-PixBuf vulnerabilities

[CVE catalog]

Severity
High · CVSS 7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
1.34% · Oct 25, 2026

A flaw exists in gdk‑pixbuf within the gdk_pixbuf__jpeg_image_load_increment function (io-jpeg.c) and in glib’s g_base64_encode_step (glib/gbase64.c). When processing maliciously crafted JPEG images, a heap buffer overflow can occur during Base64 encoding, allowing out-of-bounds reads from heap memory, potentially causing application crashes or arbitrary code execution.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangdk-pixbufsid2.44.8+dfsg-1fixed
Debiangdk-pixbufforky2.44.8+dfsg-1fixed
Debiangdk-pixbuftrixie2.42.12+dfsg-4+deb13u1fixed
Debiangdk-pixbuftrixie-security2.42.12+dfsg-4+deb13u1fixed
Debiangdk-pixbufbookworm2.42.10+dfsg-1+deb12u4fixed
Debiangdk-pixbufbookworm-security2.42.10+dfsg-1+deb12u4fixed
Ubuntugdk-pixbufnoble2.42.10+dfsg-3ubuntu3.2fixed
Ubuntugdk-pixbuf-testsnoble2.42.10+dfsg-3ubuntu3.2fixed
Ubuntugir1.2-gdkpixbuf-2.0noble2.42.10+dfsg-3ubuntu3.2fixed
Ubuntulibgdk-pixbuf-2.0-0noble2.42.10+dfsg-3ubuntu3.2fixed
Ubuntulibgdk-pixbuf-2.0-devnoble2.42.10+dfsg-3ubuntu3.2fixed
Ubuntulibgdk-pixbuf2.0-binnoble2.42.10+dfsg-3ubuntu3.2fixed
Ubuntulibgdk-pixbuf2.0-commonnoble2.42.10+dfsg-3ubuntu3.2fixed
Ubuntulibgdk-pixbuf2.0-docnoble2.42.10+dfsg-3ubuntu3.2fixed
Ubuntugdk-pixbufpro2.40.0+dfsg-1build1vulnerable
Ubuntugdk-pixbufpro2.40.0+dfsg-1ubuntu1vulnerable
Ubuntugdk-pixbufpro2.40.0+dfsg-2vulnerable
Ubuntugdk-pixbufpro2.40.0+dfsg-3vulnerable
Ubuntugdk-pixbufpro2.40.0+dfsg-3ubuntu0.1vulnerable
Ubuntugdk-pixbufpro2.40.0+dfsg-3ubuntu0.2vulnerable
Ubuntugdk-pixbufpro2.40.0+dfsg-3ubuntu0.3vulnerable
Ubuntugdk-pixbufpro2.40.0+dfsg-3ubuntu0.4vulnerable
Ubuntugdk-pixbufpro2.40.0+dfsg-3ubuntu0.5vulnerable
Ubuntugdk-pixbufpro2.40.0+dfsg-3ubuntu0.5+esm1fixed
Ubuntugdk-pixbuf22.042.42.6+dfsg-1build2vulnerable
Ubuntugdk-pixbuf22.042.42.6+dfsg-1build3vulnerable
Ubuntugdk-pixbuf22.042.42.6+dfsg-2ubuntu2vulnerable
Ubuntugdk-pixbuf22.042.42.6+dfsg-2ubuntu3vulnerable
Ubuntugdk-pixbuf22.042.42.8+dfsg-1vulnerable
Ubuntugdk-pixbuf22.042.42.8+dfsg-1ubuntu0.1vulnerable
Ubuntugdk-pixbuf22.042.42.8+dfsg-1ubuntu0.2vulnerable
Ubuntugdk-pixbuf22.042.42.8+dfsg-1ubuntu0.3vulnerable
Ubuntugdk-pixbuf22.042.42.8+dfsg-1ubuntu0.4fixed
Ubuntugdk-pixbuf24.042.42.10+dfsg-1build1vulnerable
Ubuntugdk-pixbuf24.042.42.10+dfsg-3vulnerable
Ubuntugdk-pixbuf24.042.42.10+dfsg-3ubuntu1vulnerable
Ubuntugdk-pixbuf24.042.42.10+dfsg-3ubuntu2vulnerable
Ubuntugdk-pixbuf24.042.42.10+dfsg-3ubuntu3vulnerable
Ubuntugdk-pixbuf24.042.42.10+dfsg-3ubuntu3.1vulnerable
Ubuntugdk-pixbuf24.042.42.10+dfsg-3ubuntu3.2fixed
Ubuntugdk-pixbuf25.102.42.12+dfsg-2vulnerable
Ubuntugdk-pixbuf25.102.42.12+dfsg-3vulnerable
Ubuntugdk-pixbuf25.102.42.12+dfsg-4build1fixed
Opensusegdk-pixbuftumbleweed2.42.12-5.1fixed
Susegdk-pixbuflinux enterprise server 12 sp5-ltss2.34.0-19.23.1fixed
Susegdk-pixbuflinux enterprise server ltss extended security 12 sp52.34.0-19.23.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangdk-pixbufsourcesid2.42.12+dfsg-4not yet assignedNot reported[1109262]
Debiangdk-pixbufsourceforky2.42.12+dfsg-4not yet assignedNot reported[1109262]
Debiangdk-pixbufsourcetrixie2.42.12+dfsg-4not yet assignedNot reported[1109262]
Debiangdk-pixbufsourcebookworm2.42.10+dfsg-1+deb12u3not yet assignedNot reported[1109262]
Ubuntugdk-pixbufdebnoble2.42.10+dfsg-3ubuntu3.2Not reportedNot reportedNot reported
Ubuntugdk-pixbuf-testsdebnoble2.42.10+dfsg-3ubuntu3.2Not reportedNot reportedNot reported
Ubuntugir1.2-gdkpixbuf-2.0debnoble2.42.10+dfsg-3ubuntu3.2Not reportedNot reportedNot reported
Ubuntulibgdk-pixbuf-2.0-0debnoble2.42.10+dfsg-3ubuntu3.2Not reportedNot reportedNot reported
Ubuntulibgdk-pixbuf-2.0-devdebnoble2.42.10+dfsg-3ubuntu3.2Not reportedNot reportedNot reported
Ubuntulibgdk-pixbuf2.0-bindebnoble2.42.10+dfsg-3ubuntu3.2Not reportedNot reportedNot reported
Ubuntulibgdk-pixbuf2.0-commondebnoble2.42.10+dfsg-3ubuntu3.2Not reportedNot reportedNot reported
Ubuntulibgdk-pixbuf2.0-docdebnoble2.42.10+dfsg-3ubuntu3.2Not reportedNot reportedNot reported
Ubuntugdk-pixbufdebpro2.40.0+dfsg-3ubuntu0.5+esm1Not reportedUBUNTU-CVE-2025-7345Not reported
Ubuntugdk-pixbufdeb22.042.42.8+dfsg-1ubuntu0.4Not reportedUBUNTU-CVE-2025-7345Not reported
Ubuntugdk-pixbufdeb24.042.42.10+dfsg-3ubuntu3.2Not reportedUBUNTU-CVE-2025-7345Not reported
Ubuntugdk-pixbufdeb25.102.42.12+dfsg-4build1Not reportedUBUNTU-CVE-2025-7345Not reported
Opensusegdk-pixbufrpmtumbleweed2.42.12-5.1Not reportedOPENSUSE-SU-2025:15468-1Not reported
Susegdk-pixbufrpmlinux enterprise server 12 sp5-ltss2.34.0-19.23.1Not reportedSUSE-SU-2025:03010-1Not reported
Susegdk-pixbufrpmlinux enterprise server ltss extended security 12 sp52.34.0-19.23.1Not reportedSUSE-SU-2025:03010-1Not reported

[Debian bug #1109262]

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [gdk-pixbuf-devel]Unknown

    Source package: [gdk-pixbuf]

    Details (1)

    • 2.44.7-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 2.42.12-5.1

      Version impact unknown

      usn · gdk-pixbuf · opensuse · tumbleweed

  • [gdk-pixbuf-devel-32bit]Unknown

    Source package: [gdk-pixbuf]

    Details (1)

    • 2.44.7-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 2.42.12-5.1

      Version impact unknown

      usn · gdk-pixbuf · opensuse · tumbleweed

  • [gdk-pixbuf-lang]Unknown

    Source package: [gdk-pixbuf]

    Details (1)

    • 2.44.7-1.2 · noarch · tumbleweed

      Unknown · Fixed: 2.42.12-5.1

      Version impact unknown

      usn · gdk-pixbuf · opensuse · tumbleweed

  • [gdk-pixbuf-query-loaders]Unknown

    Source package: [gdk-pixbuf]

    Details (1)

    • 2.44.7-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 2.42.12-5.1

      Version impact unknown

      usn · gdk-pixbuf · opensuse · tumbleweed

  • [gdk-pixbuf-query-loaders-32bit]Unknown

    Source package: [gdk-pixbuf]

    Details (1)

    • 2.44.7-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 2.42.12-5.1

      Version impact unknown

      usn · gdk-pixbuf · opensuse · tumbleweed

  • [libgdk_pixbuf-2_0-0]Unknown

    Source package: [gdk-pixbuf]

    Details (1)

    • 2.44.7-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 2.42.12-5.1

      Version impact unknown

      usn · gdk-pixbuf · opensuse · tumbleweed

  • [libgdk_pixbuf-2_0-0-32bit]Unknown

    Source package: [gdk-pixbuf]

    Details (1)

    • 2.44.7-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 2.42.12-5.1

      Version impact unknown

      usn · gdk-pixbuf · opensuse · tumbleweed

  • [typelib-1_0-GdkPixbuf-2_0]Unknown

    Source package: [gdk-pixbuf]

    Details (1)

    • 2.44.7-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 2.42.12-5.1

      Version impact unknown

      usn · gdk-pixbuf · opensuse · tumbleweed

  • [typelib-1_0-GdkPixdata-2_0]Unknown

    Source package: [gdk-pixbuf]

    Details (1)

    • 2.44.7-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 2.42.12-5.1

      Version impact unknown

      usn · gdk-pixbuf · opensuse · tumbleweed

[Debian 12 (Bookworm)]

  • [gdk-pixbuf-tests]Fixed

    Source package: [gdk-pixbuf]

    Details (4)

    • 2.42.10+dfsg-1+deb12u4 · amd64 · bookworm

      Fixed · Fixed: 2.42.10+dfsg-1+deb12u3

      usn · gdk-pixbuf · debian · bookworm; usn · gdk-pixbuf · debian · 12

    • 2.42.10+dfsg-1+deb12u4 · arm64 · bookworm

      Fixed · Fixed: 2.42.10+dfsg-1+deb12u3

      usn · gdk-pixbuf · debian · bookworm; usn · gdk-pixbuf · debian · 12

    • 2.42.10+dfsg-1+deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 2.42.10+dfsg-1+deb12u3

      usn · gdk-pixbuf · debian · bookworm; usn · gdk-pixbuf · debian · 12

    • 2.42.10+dfsg-1+deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 2.42.10+dfsg-1+deb12u3

      usn · gdk-pixbuf · debian · bookworm; usn · gdk-pixbuf · debian · 12

  • [gir1.2-gdkpixbuf-2.0]Fixed

    Source package: [gdk-pixbuf]

    Details (4)

    • 2.42.10+dfsg-1+deb12u4 · amd64 · bookworm

      Fixed · Fixed: 2.42.10+dfsg-1+deb12u3

      usn · gdk-pixbuf · debian · bookworm; usn · gdk-pixbuf · debian · 12

    • 2.42.10+dfsg-1+deb12u4 · arm64 · bookworm

      Fixed · Fixed: 2.42.10+dfsg-1+deb12u3

      usn · gdk-pixbuf · debian · bookworm; usn · gdk-pixbuf · debian · 12

    • 2.42.10+dfsg-1+deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 2.42.10+dfsg-1+deb12u3

      usn · gdk-pixbuf · debian · bookworm; usn · gdk-pixbuf · debian · 12

    • 2.42.10+dfsg-1+deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 2.42.10+dfsg-1+deb12u3

      usn · gdk-pixbuf · debian · bookworm; usn · gdk-pixbuf · debian · 12

  • [libgdk-pixbuf-2.0-0]Fixed

    Source package: [gdk-pixbuf]

    Details (4)

    • 2.42.10+dfsg-1+deb12u4 · amd64 · bookworm

      Fixed · Fixed: 2.42.10+dfsg-1+deb12u3

      usn · gdk-pixbuf · debian · bookworm; usn · gdk-pixbuf · debian · 12

    • 2.42.10+dfsg-1+deb12u4 · arm64 · bookworm

      Fixed · Fixed: 2.42.10+dfsg-1+deb12u3

      usn · gdk-pixbuf · debian · bookworm; usn · gdk-pixbuf · debian · 12

    • 2.42.10+dfsg-1+deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 2.42.10+dfsg-1+deb12u3

      usn · gdk-pixbuf · debian · bookworm; usn · gdk-pixbuf · debian · 12

    • 2.42.10+dfsg-1+deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 2.42.10+dfsg-1+deb12u3

      usn · gdk-pixbuf · debian · bookworm; usn · gdk-pixbuf · debian · 12

  • [libgdk-pixbuf2.0-bin]Fixed

    Source package: [gdk-pixbuf]

    Details (4)

    • 2.42.10+dfsg-1+deb12u4 · amd64 · bookworm

      Fixed · Fixed: 2.42.10+dfsg-1+deb12u3

      usn · gdk-pixbuf · debian · bookworm; usn · gdk-pixbuf · debian · 12

    • 2.42.10+dfsg-1+deb12u4 · arm64 · bookworm

      Fixed · Fixed: 2.42.10+dfsg-1+deb12u3

      usn · gdk-pixbuf · debian · bookworm; usn · gdk-pixbuf · debian · 12

    • 2.42.10+dfsg-1+deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 2.42.10+dfsg-1+deb12u3

      usn · gdk-pixbuf · debian · bookworm; usn · gdk-pixbuf · debian · 12

    • 2.42.10+dfsg-1+deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 2.42.10+dfsg-1+deb12u3

      usn · gdk-pixbuf · debian · bookworm; usn · gdk-pixbuf · debian · 12

  • [libgdk-pixbuf2.0-common]Fixed

    Source package: [gdk-pixbuf]

    Details (4)

    • 2.42.10+dfsg-1+deb12u4 · all · bookworm

      Fixed · Fixed: 2.42.10+dfsg-1+deb12u3

      usn · gdk-pixbuf · debian · bookworm; usn · gdk-pixbuf · debian · 12

    • 2.42.10+dfsg-1+deb12u4 · all · bookworm

      Fixed · Fixed: 2.42.10+dfsg-1+deb12u3

      usn · gdk-pixbuf · debian · bookworm; usn · gdk-pixbuf · debian · 12

    • 2.42.10+dfsg-1+deb12u4 · all · bookworm-security

      Fixed · Fixed: 2.42.10+dfsg-1+deb12u3

      usn · gdk-pixbuf · debian · bookworm; usn · gdk-pixbuf · debian · 12

    • 2.42.10+dfsg-1+deb12u4 · all · bookworm-security

      Fixed · Fixed: 2.42.10+dfsg-1+deb12u3

      usn · gdk-pixbuf · debian · bookworm; usn · gdk-pixbuf · debian · 12

  • [libgdk-pixbuf-2.0-dev]Fixed

    Source package: [gdk-pixbuf]

    Details (4)

    • 2.42.10+dfsg-1+deb12u4 · amd64 · bookworm

      Fixed · Fixed: 2.42.10+dfsg-1+deb12u3

      usn · gdk-pixbuf · debian · bookworm; usn · gdk-pixbuf · debian · 12

    • 2.42.10+dfsg-1+deb12u4 · arm64 · bookworm

      Fixed · Fixed: 2.42.10+dfsg-1+deb12u3

      usn · gdk-pixbuf · debian · bookworm; usn · gdk-pixbuf · debian · 12

    • 2.42.10+dfsg-1+deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 2.42.10+dfsg-1+deb12u3

      usn · gdk-pixbuf · debian · bookworm; usn · gdk-pixbuf · debian · 12

    • 2.42.10+dfsg-1+deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 2.42.10+dfsg-1+deb12u3

      usn · gdk-pixbuf · debian · bookworm; usn · gdk-pixbuf · debian · 12

  • [libgdk-pixbuf2.0-doc]Fixed

    Source package: [gdk-pixbuf]

    Details (4)

    • 2.42.10+dfsg-1+deb12u4 · all · bookworm

      Fixed · Fixed: 2.42.10+dfsg-1+deb12u3

      usn · gdk-pixbuf · debian · bookworm; usn · gdk-pixbuf · debian · 12

    • 2.42.10+dfsg-1+deb12u4 · all · bookworm

      Fixed · Fixed: 2.42.10+dfsg-1+deb12u3

      usn · gdk-pixbuf · debian · bookworm; usn · gdk-pixbuf · debian · 12

    • 2.42.10+dfsg-1+deb12u4 · all · bookworm-security

      Fixed · Fixed: 2.42.10+dfsg-1+deb12u3

      usn · gdk-pixbuf · debian · bookworm; usn · gdk-pixbuf · debian · 12

    • 2.42.10+dfsg-1+deb12u4 · all · bookworm-security

      Fixed · Fixed: 2.42.10+dfsg-1+deb12u3

      usn · gdk-pixbuf · debian · bookworm; usn · gdk-pixbuf · debian · 12

[Debian 13 (Trixie)]

  • [gdk-pixbuf-tests]Fixed

    Source package: [gdk-pixbuf]

    Details (4)

    • 2.42.12+dfsg-4+deb13u1 · amd64 · trixie

      Fixed · Fixed: 2.42.12+dfsg-4

      usn · gdk-pixbuf · debian · 13

    • 2.42.12+dfsg-4+deb13u1 · arm64 · trixie

      Fixed · Fixed: 2.42.12+dfsg-4

      usn · gdk-pixbuf · debian · 13

    • 2.42.12+dfsg-4+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 2.42.12+dfsg-4

      usn · gdk-pixbuf · debian · 13

    • 2.42.12+dfsg-4+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 2.42.12+dfsg-4

      usn · gdk-pixbuf · debian · 13

  • [gir1.2-gdkpixbuf-2.0]Fixed

    Source package: [gdk-pixbuf]

    Details (4)

    • 2.42.12+dfsg-4+deb13u1 · amd64 · trixie

      Fixed · Fixed: 2.42.12+dfsg-4

      usn · gdk-pixbuf · debian · 13

    • 2.42.12+dfsg-4+deb13u1 · arm64 · trixie

      Fixed · Fixed: 2.42.12+dfsg-4

      usn · gdk-pixbuf · debian · 13

    • 2.42.12+dfsg-4+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 2.42.12+dfsg-4

      usn · gdk-pixbuf · debian · 13

    • 2.42.12+dfsg-4+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 2.42.12+dfsg-4

      usn · gdk-pixbuf · debian · 13

  • [libgdk-pixbuf-2.0-0]Fixed

    Source package: [gdk-pixbuf]

    Details (4)

    • 2.42.12+dfsg-4+deb13u1 · amd64 · trixie

      Fixed · Fixed: 2.42.12+dfsg-4

      usn · gdk-pixbuf · debian · 13

    • 2.42.12+dfsg-4+deb13u1 · arm64 · trixie

      Fixed · Fixed: 2.42.12+dfsg-4

      usn · gdk-pixbuf · debian · 13

    • 2.42.12+dfsg-4+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 2.42.12+dfsg-4

      usn · gdk-pixbuf · debian · 13

    • 2.42.12+dfsg-4+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 2.42.12+dfsg-4

      usn · gdk-pixbuf · debian · 13

  • [libgdk-pixbuf2.0-bin]Fixed

    Source package: [gdk-pixbuf]

    Details (4)

    • 2.42.12+dfsg-4+deb13u1 · amd64 · trixie

      Fixed · Fixed: 2.42.12+dfsg-4

      usn · gdk-pixbuf · debian · 13

    • 2.42.12+dfsg-4+deb13u1 · arm64 · trixie

      Fixed · Fixed: 2.42.12+dfsg-4

      usn · gdk-pixbuf · debian · 13

    • 2.42.12+dfsg-4+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 2.42.12+dfsg-4

      usn · gdk-pixbuf · debian · 13

    • 2.42.12+dfsg-4+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 2.42.12+dfsg-4

      usn · gdk-pixbuf · debian · 13

Next results

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]