Junglewise Threat Intelligence

CVE-2026-5201: GNOME gdk-pixbuf heap buffer overflow in JPEG loader

CVE-2026-5201 · Severity: high · CVSS 7.5 · Published 2026-03-31

Technologies: Red Hat Enterprise Linux, Gnome Gdk-Pixbuf2. Vendors: Red Hat, Gnome.

Executive brief

A vulnerability has been identified in gdk-pixbuf, a widely used library for loading and displaying images in Linux environments. By tricking a system into processing a specially crafted JPEG image—such as through automated thumbnail generation—an attacker can cause applications to crash. This can lead to a denial of service, disrupting operations and affecting the availability of systems that rely on this library for image processing.

Technical details

A heap-based buffer overflow vulnerability (CWE-122) exists in the gdk-pixbuf library's JPEG image loader. The flaw is caused by improper validation of color component counts when processing JPEG data. A remote, unauthenticated attacker can exploit this by providing a malicious JPEG image that triggers the overflow during processing (e.g., during thumbnailing or viewing). Successful exploitation results in an application crash, leading to a denial of service (DoS) condition. Security updates have been released by Red Hat and other distributions to address this issue.

Affected products

  • GNOME gdk-pixbuf2 2.42.12, 2.42.6
  • Red Hat Enterprise Linux 7.0, 8.0, 9.0, 10.0

Timeline

  • 2026-03-31: disclosed: Initial vulnerability publication
  • 2026-04-27: patched: Red Hat released security advisories RHSA-2026:10707 and RHSA-2026:10708

References