What’s Vulnerable › Vulnerabilities

CVE-2025-59820

• Severity: medium (CVSS 6.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-11-26 · updated 2026-10-18
• Weakness: CWE-1284

Description

In KDE Krita before 5.2.13, loading a manipulated TGA file could result in a heap-based buffer overflow in plugins/impex/tga/kis_tga_import.cpp (aka KisTgaImport). Control flow proceeds even when a number of pixels becomes negative.

Affected products

• KDE Krita: before 5.2.13 — fixed in 5.2.13

How to fix

Upgrade to a fixed version: KDE Krita 5.2.13. Check the vendor advisory for mitigations.

References

• https://invent.kde.org/graphics/krita/
• https://invent.kde.org/graphics/krita/-/commit/6d3651ac4df88efb68e013d21061de9846e83fe8
• https://kde.org/info/security/advisory-20250929-1.txt
• https://lists.debian.org/debian-lts-announce/2025/12/msg00006.html

Get alerted when CVE-2025-59820 or the next vulnerability affects your stack