CVE-2025-44906

jhead v3.08 was discovered to contain a heap-use-after-free via the ProcessFile function at jhead.c.

7.8 HighFix available

jhead v3.08 was discovered to contain a heap-use-after-free via the ProcessFile function at jhead.c.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.27%Up 0.2 points since May 30, 2025

What each source reports

CVE List Score used 7.8

jhead v3.08 was discovered to contain a heap-use-after-free via the ProcessFile function at jhead.c.

Record: CVE-2025-44906
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

EUVDEUVD-2025-16462 7.8

jhead v3.08 was discovered to contain a heap-use-after-free via the ProcessFile function at jhead.c.

Record: EUVD-2025-16462
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-4q97-mrgv-92q2 7.8

jhead v3.08 was discovered to contain a heap-use-after-free via the ProcessFile function at jhead.c.

jhead v3.08 was discovered to contain a heap-use-after-free via the ProcessFile function at jhead.c.

Record: GHSA-4q97-mrgv-92q2
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

NVD 7.8

jhead v3.08 was discovered to contain a heap-use-after-free via the ProcessFile function at jhead.c.

Record: CVE-2025-44906
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

OSV 7.8

jhead v3.08 was discovered to contain a heap-use-after-free via the ProcessFile function at jhead.c.

Record: CVE-2025-44906
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2025-44906 7.8

jhead v3.08 was discovered to contain a heap-use-after-free via the ProcessFile function at jhead.c.

Record: DEBIAN-CVE-2025-44906
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2025-44906 7.8

jhead v3.08 was discovered to contain a heap-use-after-free via the ProcessFile function at jhead.c.

Record: UBUNTU-CVE-2025-44906
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVopenSUSE-SU-2026:21915-1 No score

Security update for budgie-backgrounds

This update for budgie-backgrounds fixes the following issues:

Changes in budgie-backgrounds:

Convert images to JXL, add submission format policy, drop jhead dep because of CVE-2025-44906 (bsc#1243819)

Record: openSUSE-SU-2026:21915-1
Updated: 2026-11-02

Affected products

jhead project jhead

Affected packages

Affected packages
Package	Affected	Fixed
`jhead` Ubuntu:Pro:14.04:LTS	All versions, plus listed versions 1:2.97-11:2.97-1+deb8u1build0.14.04.11:2.97-1+deb8u2build0.14.04.1~esm11:2.97-1+deb8u2ubuntu0.1~esm11:2.97-1+deb8u2ubuntu0.1~esm21:2.97-1+deb8u2ubuntu0.1~esm31:2.97-1+deb8u2ubuntu0.1~esm4	None known
`jhead` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 1:3.00-11:3.00-21:3.00-31:3.00-4+deb9u1build0.16.04.11:3.00-4+deb9u1ubuntu0.1~esm11:3.00-4+deb9u1ubuntu0.1~esm21:3.00-4+deb9u1ubuntu0.1~esm31:3.00-4+deb9u1ubuntu0.1~esm4	None known
`jhead` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 1:3.00-41:3.00-51:3.00-61:3.00-8~build0.18.04.11:3.00-8~ubuntu0.11:3.00-8~ubuntu0.21:3.00-8~ubuntu0.2+esm1	None known
`jhead` Ubuntu:Pro:20.04:LTS	All versions, plus listed versions 1:3.03-31:3.04-11:3.04-1ubuntu0.11:3.04-1ubuntu0.21:3.04-1ubuntu0.2+esm1	None known
`jhead` Ubuntu:Pro:22.04:LTS	All versions, plus listed versions 1:3.04-61:3.06.0.1-21:3.06.0.1-2ubuntu0.22.04.11:3.06.0.1-2ubuntu0.22.04.1+esm1	None known
`jhead` Ubuntu:24.04:LTS	All versions, plus listed versions 1:3.08-11:3.08-2	None known
`jhead` Ubuntu:25.10	All versions, plus listed versions 1:3.08-3	None known
`jhead` Ubuntu:26.10	All versions, plus listed versions 1:3.08-3build1	None known
`jhead` Ubuntu:26.04:LTS	All versions, plus listed versions 1:3.08-31:3.08-3build1	None known
`budgie-backgrounds` openSUSE:Leap 16.0	before 3.0-bp160.2.1	3.0-bp160.2.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	affected
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-44906 is a high vulnerability (CVSS 7.8) in Jhead Project Jhead, published May 30, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 19th percentile. Fixed in budgie-backgrounds 3.0-bp160.2.1.

References

Show 4 moreShow less