CVE-2025-59820: Kde Krita

Medium severity, CVSS 6.7. EPSS: 0.2% chance of exploitation in the next 30 days.

In KDE Krita before 5.2.13, loading a manipulated TGA file could result in a heap-based buffer overflow in plugins/impex/tga/kis_tga_import.cpp (aka KisTgaImport). Control flow proceeds even when a number of pixels becomes negative.

Affected products

• Kde Krita: before 5.2.13 (fixed in 5.2.13)

Published 2025-11-26. Last modified 2026-06-17.