CVE-2025-59820CWE-1284

CVE-2025-59820

Medium · published November 26, 2025

CVSS v3.1
6.7
EPSS
0%
Percentile
10.1
In the wild
Unconfirmed
What it is

In KDE Krita before 5.2.13, loading a manipulated TGA file could result in a heap-based buffer overflow in plugins/impex/tga/kis_tga_import.cpp (aka KisTgaImport). Control flow proceeds even when a number of pixels becomes negative.

The record
Technical detail
CVSS v3.1
6.7 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00206 · 10.1th percentile
Weakness
CWE-1284 · Improper Validation of Specified Quantity in Input
Published
2025-11-26T11:15Z
References (4)
https://invent.kde.org/graphics/krita/ · [email protected]https://invent.kde.org/graphics/krita/-/commit/6d3651ac4df88efb68e013d21061de9846e83fe8 · [email protected]https://kde.org/info/security/advisory-20250929-1.txt · [email protected]https://lists.debian.org/debian-lts-announce/2025/12/msg00006.html · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 26 NOV 00:00Z
    In KDE Krita before 5.2.13, loading a manipulated TGA file could result in a heap-based buffer overflow in plugins/impex/tga/kis_tga_import.cpp (aka…
    cvelistv5