CVE-2025-54575: SixLabors ImageSharp Has Infinite Loop in GIF Decoder When Skipping Malformed Comment Extension Blocks
(updated )
A specially crafted GIF file containing a malformed comment extension block (with a missing block terminator) can cause the ImageSharp GIF decoder to enter an infinite loop while attempting to skip the block. This leads to a denial of service. Applications processing untrusted GIF input should upgrade to a patched version.
References
- github.com/SixLabors/ImageSharp
- github.com/SixLabors/ImageSharp/commit/55e49262df9a057dff9b7807ed1b7bdb49187c3f
- github.com/SixLabors/ImageSharp/commit/833f3ceec35af6b775950e06f03b934546cefbf6
- github.com/SixLabors/ImageSharp/issues/2953
- github.com/SixLabors/ImageSharp/security/advisories/GHSA-rxmq-m78w-7wmc
- github.com/advisories/GHSA-rxmq-m78w-7wmc
- nvd.nist.gov/vuln/detail/CVE-2025-54575
Code Behaviors & Features
Detect and mitigate CVE-2025-54575 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →