Junglewise Threat Intelligence

CVE-2025-7345: GNOME gdk-pixbuf heap buffer overflow in JPEG loading

CVE-2025-7345 · Severity: high · CVSS 7.5 · Published 2025-07-08

Technologies: Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Gnome Gdk-Pixbuf, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10. Vendors: Red Hat, Gnome.

Executive brief

A security vulnerability has been identified in gdk-pixbuf, a widely used library for loading and displaying images in Linux environments. By tricking a system into processing a specially crafted JPEG image, an attacker could cause the application to crash or potentially execute unauthorized commands. This impact could lead to service disruptions or unauthorized access to data handled by affected applications.

Technical details

A heap-based buffer overflow exists in gdk-pixbuf within the gdk_pixbuf__jpeg_image_load_increment function (io-jpeg.c) and in glib's g_base64_encode_step (glib/gbase64.c). The flaw is triggered during the Base64 encoding process when handling maliciously crafted JPEG images. An attacker can exploit this to perform out-of-bounds reads from heap memory, which may result in a denial-of-service (application crash) or arbitrary code execution. The vulnerability is reachable over the network without authentication if an application processes untrusted image input. Patches have been released by GNOME and various Linux distributions including Red Hat and Debian.

Affected products

  • GNOME gdk-pixbuf < 2.43.4
  • Red Hat Red Hat Enterprise Linux 10 < 2.42.12-4.el10_0
  • Red Hat Red Hat Enterprise Linux 9 < 2.42.6-6.el9_6
  • Red Hat Red Hat Enterprise Linux 8 < 2.36.12-7.el8_10
  • Red Hat Red Hat Enterprise Linux 7 < 2.36.12-4.el7_9

Timeline

  • 2025-07-08: disclosed
  • 2025-08-05: patched: Red Hat released security updates for RHEL 9 and 10.

References

Related threats