CVE-2025-2720

A vulnerability was found in GNOME libgsf, affecting the gsf_base64_encode_simple function. The attack needs to be approached locally, and manipulation of the size argument can lead to use of an uninitialized variable.

This CVE has been marked as Rejected by the assigning CNA. According to the code maintainer the call of the POC is invalid because the buffer pointed to by "data" must have "len" valid bytes. The docs were updated to make that clear.