CVE-2025-27598

ImageSharp is a 2D graphics API. An Out-of-bounds Write vulnerability has been found in the ImageSharp gif decoder, allowing attackers to cause a crash using a specially crafted gif. This can potentially lead to denial of service. The problem has been patched. All users are advised to upgrade to v3.1.7 or v2.1.10.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/SixLabors/ImageSharp/issues/2859	Exploit Issue Tracking
https://github.com/SixLabors/ImageSharp/pull/2890	Issue Tracking Patch
https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-2cmq-823j-5qj8	Vendor Advisory
https://github.com/SixLabors/ImageSharp/issues/2859	Exploit Issue Tracking

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:sixlabors:imagesharp::::::::
	cpe:2.3:a:sixlabors:imagesharp::::::::

History

No history.

Information

Published : 2025-03-06 23:15

Updated : 2025-03-24 18:36

NVD link : CVE-2025-27598

Mitre link : CVE-2025-27598

CVE.ORG link : CVE-2025-27598

JSON object : View

Products Affected

sixlabors

imagesharp

CWE

CWE-787

Out-of-bounds Write

{"id": "CVE-2025-27598", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2025-03-06T23:15:12.183", "references": [{"url": "https://github.com/SixLabors/ImageSharp/issues/2859", "tags": ["Exploit", "Issue Tracking"], "source": "[email protected]"}, {"url": "https://github.com/SixLabors/ImageSharp/pull/2890", "tags": ["Issue Tracking", "Patch"], "source": "[email protected]"}, {"url": "https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-2cmq-823j-5qj8", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "https://github.com/SixLabors/ImageSharp/issues/2859", "tags": ["Exploit", "Issue Tracking"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "ImageSharp is a 2D graphics API. An Out-of-bounds Write vulnerability has been found in the ImageSharp gif decoder, allowing attackers to cause a crash using a specially crafted gif. This can potentially lead to denial of service. The problem has been patched. All users are advised to upgrade to v3.1.7 or v2.1.10."}, {"lang": "es", "value": "ImageSharp es una API de gr\u00e1ficos 2D. Se ha encontrado una vulnerabilidad de escritura fuera de los l\u00edmites en el decodificador de gifs de ImageSharp, que permite a los atacantes provocar un bloqueo utilizando un gif especialmente manipulado. Esto puede provocar una denegaci\u00f3n de servicio. El problema ha sido corregido. Se recomienda a todos los usuarios que actualicen a la versi\u00f3n 3.1.7 o 2.1.10."}], "lastModified": "2025-03-24T18:36:19.670", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sixlabors:imagesharp:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "579B75C1-2EA3-425B-9239-A749A3E31B71", "versionEndExcluding": "2.1.10"}, {"criteria": "cpe:2.3:a:sixlabors:imagesharp:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8918B322-D6CF-4EA6-BD5D-FB9F1938ABBE", "versionEndExcluding": "3.1.7", "versionStartIncluding": "3.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}