CoreCVE
Back

HIGH

Gdk-pixbuf: gdk-pixbuf: denial of service via heap-based buffer overflow when processing a specially crafted jpeg image

Published Mar 31, 2026

Description

A flaw was found in the gdk-pixbuf library. This heap-based buffer overflow vulnerability occurs in the JPEG image loader due to improper validation of color component counts when processing a specially crafted JPEG image. A remote attacker can exploit this flaw without user interaction, for example, via thumbnail generation. Successful exploitation leads to application crashes and denial of service (DoS) conditions.

Affected products

Remediation

Vendor solution

To reduce the risk of exploitation, avoid opening or processing untrusted JPEG image files. This operational control helps prevent the automatic triggering of the vulnerability, for example, during thumbnail generation, which could otherwise lead to application instability.

Red Hat statement

An Important heap-based buffer overflow flaw exists in the `gdk-pixbuf` library's JPEG image loader. This vulnerability can be triggered automatically without user interaction when processing a specially crafted JPEG image, such as during thumbnail generation. Successful exploitation leads to application crashes and denial-of-service conditions in applications utilizing `gdk-pixbuf` for image handling.

Red Hat mitigation

To reduce the risk of exploitation, avoid opening or processing untrusted JPEG image files. This operational control helps prevent the automatic triggering of the vulnerability, for example, during thumbnail generation, which could otherwise lead to application instability.

Weaknesses (1)

CWE-122

References (29)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner redhat
Published Mar 31, 2026
Updated Jul 15, 2026
Reserved Mar 31, 2026
Link CVE-2026-5201
CISA Vulnrichment
Updated Mar 31, 2026
NVD
Status Modified
Modified Jul 15, 2026
Link CVE-2026-5201
Red Hat
Severity Important
Public date Mar 31, 2026
Links CVE-2026-5201 - Bugzilla