Bug 2487296 (CVE-2025-71319) - CVE-2025-71319 image-size: image-size: Denial of Service due to infinite loop when processing specially crafted images.
Summary: CVE-2025-71319 image-size: image-size: Denial of Service due to infinite loop...
Keywords:
Status: NEW
Alias: CVE-2025-71319
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2491961 2491962 2491965 2491966 2491960 2491963 2491964 2491967
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-06-09 21:01 UTC by OSIDB Bzimport
Modified: 2026-06-23 20:54 UTC (History)
55 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-06-09 21:01:36 UTC 
image-size 1.1.0 before 1.2.1 and 2.0.0 before 2.0.2 contain a denial of service vulnerability in the findBox function when processing specially crafted images with zero-sized boxes. Remote attackers can cause application hang by supplying malicious JXL, HEIF, or JP2 image files with box size zero, triggering infinite loops during image validation.
Note You need to log in before you can comment on or make changes to this bug.