CVE-2025-55174 json
In KDE Skanpage before 25.08.0, an attempt at file overwrite can result in the contents of the new file at the beginning followed by the pa…
published 2025-11-26 11 mo ago modified 2026-10-18 21 d ago also EUVD-2025-199713
- cvss
- 3.2
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 4%
- public exploits
- 0
- none known
Summary
In KDE Skanpage before 25.08.0, an attempt at file overwrite can result in the contents of the new file at the beginning followed by the partial contents of the old file at the end, because of use of QIODevice::ReadWrite instead of QODevice::WriteOnly.
Patch / fix
- KDE Skanpage 25.08.0
- skanpage Debian 13 25.04.2-1+deb13u1
- skanpage Debian 14 25.12.3-1
debian advisories DEBIAN-CVE-2025-55174
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2025-55174 updated cvss 3.2
Skanpage: Skanpage: Partial file overwrite vulnerability due to incorrect I/O device usage
-
Red Hat All currently supported Red Hat productsnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 11 mo ago
Exploit prediction
0.15% chance of exploitation in the next 30 days, higher than 4% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 3.2 | CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N |
Affected products
- KDE Skanpage
Classification
- Weakness
-
- CWE-684 Incorrect Provision of Specified Functionality
References
Sources
- CVE List CVE-2025-55174
- NVD CVE-2025-55174
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.