PT-2025-44072 · Krita +1 · Krita +1

Published 2025-01-01 · Updated 2025-11-29 · CVE-2025-59820

Positive Technologies · (AI Summary)

CVSS v3.1

6.7

6.7

Medium

Base vector

AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions Krita versions prior to 5.2.13 Krita versions 5.1.5+dfsg-2+deb12u1 through 5.1.5+dfsg-2+deb12u1 Krita versions 5.2.9+dfsg-1+deb13u1 through 5.2.9+dfsg-1+deb13u1

Description A heap-based buffer overflow exists in the TGA parser of Krita, a creative application for raster images. Loading a manipulated TGA file can lead to a buffer overflow in the

kis tga import.cpp

file (also known as

KisTgaImport

). Specifically, control flow continues even when the number of pixels is negative. This issue could potentially allow for arbitrary code execution if a specially crafted image is opened.

Recommendations Upgrade Krita to version 5.2.13 or later. Upgrade Krita packages to version 1:5.1.5+dfsg-2+deb12u1 for Debian oldstable (bookworm). Upgrade Krita packages to version 1:5.2.9+dfsg-1+deb13u1 for Debian stable (trixie).

Fix

RCE

Weakness Enumeration

CWE-1284

Related Identifiers

ALT-PU-2025-12859

CVE-2025-59820

DSA-6065-1

ZDI-25-972

Affected Products

Debian

Krita

References · 16

• https://security-tracker.debian.org/tracker/CVE-2025-59820 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-6065-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/krita · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-25-972 · Security Note
• https://errata.altlinux.org/ALT-PU-2025-12859 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59820 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-59820 · Security Note
• https://twitter.com/the_c_protocol/status/1994572061100888416 · Twitter Post
• https://packages.debian.org/src:krita · Note
• https://t.me/cveNotify/144054 · Telegram Post
• https://invent.kde.org/graphics/krita · Note
• https://twitter.com/SystemTek_UK/status/1983994899889283548 · Twitter Post
• https://kde.org/info/security/advisory-20250929-1.txt · Note
• https://twitter.com/CVEnew/status/1993566574905549213 · Twitter Post
• https://t.me/CVEtracker/38277 · Telegram Post