CVE-2025-59820

Published: Nov 26, 2025Modified: Jun 17, 2026Deferred

6.7

Vector

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N

Exploitability: 1.4 / Impact: 4.7

Source: MITRE (Secondary)

Description

In KDE Krita before 5.2.13, loading a manipulated TGA file could result in a heap-based buffer overflow in plugins/impex/tga/kis_tga_import.cpp (aka KisTgaImport). Control flow proceeds even when a number of pixels becomes negative.

Related CWEs

CWE-1284

Improper Validation of Specified Quantity in Input

The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

References (4)

https://invent.kde.org/graphics/krita/

Source: cve@mitre.org

https://invent.kde.org/graphics/krita/-/commit/6d3651ac4df88efb68e013d21061de9846e83fe8

Source: cve@mitre.org

https://kde.org/info/security/advisory-20250929-1.txt

Source: cve@mitre.org

https://lists.debian.org/debian-lts-announce/2025/12/msg00006.html

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.