VDB
CVE-2025-59820
CVE-2025-59820
PUBLISHED
CVSS 6.699999809265137 MEDIUM
In KDE Krita before 5.2.13, loading a manipulated TGA file could result in a heap-based buffer overflow in plugins/impex/tga/kis_tga_import.cpp (aka KisTgaImport). Control flow proceeds even when a number of pixels becomes negative.
EPSS 0.21% · 10.6th percentile
Risk Scores
CVSS 3.1
6.699999809265137
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N
EPSS Score
0.21%
10.6th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| KDE | Krita | 0 |
Timeline
- Sep 25, 2025 CVE Published
- Sep 30, 2025 PoC Published
- Oct 27, 2025 PoC Published
- Nov 26, 2025 EPSS Score
- Nov 26, 2025 PoC Published
- Nov 26, 2025 CVE Updated
- Dec 1, 2025 EPSS Score
- Dec 6, 2025 EPSS Score
- Dec 6, 2025 PoC Published
- Dec 10, 2025 EPSS Score
- Dec 15, 2025 EPSS Score
- Dec 20, 2025 EPSS Score
References
- https://lists.debian.org/debian-lts-announce/2025/12/msg00006.html advisory
- https://invent.kde.org/graphics/krita/ url
- https://kde.org/info/security/advisory-20250929-1.txt url
- https://invent.kde.org/graphics/krita/-/commit/6d3651ac4df88efb68e013d21061de9846e83fe8 url
- https://nvd.nist.gov/vuln/detail/CVE-2025-59820 advisory
- https://invent.kde.org/graphics/krita url