CoreCVE
Back

HIGH

gnome: heap memory corruption on gdk-pixbuf

Published Jan 26, 2024

Description

In GNOME GdkPixbuf (aka gdk-pixbuf) through 2.42.10, the ANI (Windows animated cursor) decoder encounters heap memory corruption (in ani_load_chunk in io-ani.c) when parsing chunks in a crafted .ani file. A crafted file could allow an attacker to overwrite heap metadata, leading to a denial of service or code execution attack. This occurs in gdk_pixbuf_set_option() in gdk-pixbuf.c.

Affected products

Remediation

Red Hat statement

The vulnerability in the GdkPixbuf library, allowing for heap-based out-of-bounds writes when loading crafted ANI files, poses a moderate severity risk. While the flaw could lead to memory corruption and potential denial of service or arbitrary code execution, its impact is somewhat mitigated by factors such as the need for the attacker to craft specifically malicious ANI files and the requirement for user interaction to open these files. Additionally, exploitation is limited to systems where GdkPixbuf is used to handle ANI files, reducing the overall attack surface.

Red Hat mitigation

This flaw can be mitigated by the user avoiding to load .ani files from untrusted sources.

Weaknesses (1)

CWE-787

Out-of-bounds Write

References (5)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Jan 26, 2024
Updated Aug 26, 2024
Reserved Jan 26, 2024
Link CVE-2022-48622
CISA Vulnrichment
Updated Aug 26, 2024
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2022-48622
Red Hat
Severity Moderate
Public date Jan 26, 2024
Links CVE-2022-48622 - Bugzilla