CVE-2025-59820
In KDE Krita before 5.2.13, loading a manipulated TGA file could result in a heap-based buffer...
In KDE Krita before 5.2.13, loading a manipulated TGA file could result in a heap-based buffer overflow in plugins/impex/tga/kis_tga_import.cpp (aka KisTgaImport). Control flow proceeds even when a number of pixels becomes negative.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
In KDE Krita before 5.2.13, loading a manipulated TGA file could result in a heap-based buffer overflow in plugins/impex/tga/kis_tga_import.cpp (aka KisTgaImport). Control flow proceeds even when a number of pixels becomes negative.
- Record
CVE-2025-59820- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N - Weakness
- CWE-1284
- Updated
- 2026-11-02
EUVDEUVD-2025-199710
In KDE Krita before 5.2.13, loading a manipulated TGA file could result in a heap-based buffer overflow in plugins/impex/tga/kis_tga_import.cpp (aka KisTgaImport). Control flow proceeds even when a number of pixels becomes negative.
- Record
EUVD-2025-199710- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-r8j3-whr2-75m5
In KDE Krita before 5.2.13, loading a manipulated TGA file could result in a heap-based buffer...
In KDE Krita before 5.2.13, loading a manipulated TGA file could result in a heap-based buffer overflow in plugins/impex/tga/kis_tga_import.cpp (aka KisTgaImport). Control flow proceeds even when a number of pixels becomes negative.
- Record
GHSA-r8j3-whr2-75m5- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N - Weakness
- CWE-1284
- Updated
- 2026-11-02
NVD
In KDE Krita before 5.2.13, loading a manipulated TGA file could result in a heap-based buffer overflow in plugins/impex/tga/kis_tga_import.cpp (aka KisTgaImport). Control flow proceeds even when a number of pixels becomes negative.
- Record
CVE-2025-59820- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N - Weakness
- CWE-1284
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-59820
In KDE Krita before 5.2.13, loading a manipulated TGA file could result in a heap-based buffer overflow in plugins/impex/tga/kis_tga_import.cpp (aka KisTgaImport). Control flow proceeds even when a number of pixels becomes negative.
- Record
DEBIAN-CVE-2025-59820- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-59820
In KDE Krita before 5.2.13, loading a manipulated TGA file could result in a heap-based buffer overflow in plugins/impex/tga/kis_tga_import.cpp (aka KisTgaImport). Control flow proceeds even when a number of pixels becomes negative.
- Record
UBUNTU-CVE-2025-59820- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15577-1 No score
krita-5.2.13-1.1 on GA media
These are all security issues fixed in the krita-5.2.13-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15577-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
kritaDebian:12 |
before 1:5.1.5+dfsg-2+deb12u1, plus listed versions 1:5.1.5+dfsg-2 |
1:5.1.5+dfsg-2+deb12u1 |
kritaDebian:13 |
before 1:5.2.9+dfsg-1+deb13u1, plus listed versions 1:5.2.9+dfsg-1 |
1:5.2.9+dfsg-1+deb13u1 |
kritaDebian:14 |
before 1:5.2.13+dfsg-1, plus listed versions 1:5.2.11+dfsg-11:5.2.9+dfsg-1 |
1:5.2.13+dfsg-1 |
kritaDebian:11 |
before 1:4.4.2+dfsg-1+deb11u1, plus listed versions 1:4.4.2+dfsg-1 |
1:4.4.2+dfsg-1+deb11u1 |
kritaUbuntu:18.04:LTS |
All versions, plus listed versions 1:3.2.1+dfsg-11:3.2.1+dfsg-1build11:3.3.1+dfsg-11:3.3.2.1+dfsg-11:3.3.3+dfsg-11:4.0.0+dfsg-0ubuntu11:4.0.1+dfsg-0ubuntu1 |
None known |
kritaUbuntu:20.04:LTS |
All versions, plus listed versions 1:4.2.7.1+dfsg-11:4.2.8.2+dfsg-11:4.2.8.2+dfsg-1build11:4.2.8.2+dfsg-1build21:4.2.8.2+dfsg-1build31:4.2.8.2+dfsg-1build41:4.2.9+dfsg-1 |
None known |
kritaUbuntu:22.04:LTS |
All versions, plus listed versions 1:4.4.8+dfsg-1ubuntu11:4.4.8+dfsg-1ubuntu21:5.0.0~beta5+dfsg-1ubuntu11:5.0.0+dfsg-1ubuntu11:5.0.0+dfsg-2ubuntu11:5.0.2+dfsg-11:5.0.2+dfsg-1build1 |
None known |
kritaUbuntu:24.04:LTS |
All versions, plus listed versions 1:5.1.5+dfsg-2build21:5.2.0+dfsg-11:5.2.1+dfsg-21:5.2.2+dfsg-11:5.2.2+dfsg-2 Show 4 moreShow less1:5.2.2+dfsg-2build21:5.2.2+dfsg-2build51:5.2.2+dfsg-2build61:5.2.2+dfsg-2build8 |
None known |
kritaopenSUSE:Tumbleweed |
before 5.2.13-1.1 | 5.2.13-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-59820 is a medium vulnerability (CVSS 6.7) in Kde Krita, published September 25, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 12th percentile. Fixed in krita 1:5.1.5+dfsg-2+deb12u1.