CVE-2026-103641: Gegl: gegl04: gegl: out-of-bounds read in the radiance hdr uncompressed scanline decoder
A flaw was found in GEGL. The Radiance HDR loader reads past the end of a memory-mapped image when an uncompressed scanline is shorter than the width declared in the file header. Opening a crafted HDR file crashes the application that uses the loader.
Other sources
A flaw was found in GEGL's Radiance HDR (RGBE) image loader. rgbereaduncompressed() reads xaxis.size times 4 bytes from the memory-mapped file for every scanline and does not compare that length with the bytes remaining in the file. rgbergbetofloat() then loads those bytes. A crafted .hdr file whose declared image is larger than its scanline data can make the application that opens it crash. The pixel buffer is sized for the declared image, so this path is a read past the file mapping. It is distinct from the RLE output overflow tracked as CVE-2026-2050 and from the allocation overflow tracked as CVE-2026-18300: a height below the 32768-pixel cap still reaches the unbounded read.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications that use GEGL's Radiance HDR loader and open attacker-controlled .hdr files are exposed. The attack requires local delivery or access to a crafted file and user interaction to open it.
What does an attacker need to do to trigger the flaw?
An attacker needs to supply a crafted uncompressed Radiance HDR file whose header declares a wider image than the scanline data actually contains. When the file is opened, the loader reads beyond the mapped file data and can crash the application.
How can I recognize a potentially triggering file?
The relevant condition is an uncompressed .hdr image with scanlines shorter than the width declared in its header. Files with a declared image height below 32768 pixels can still reach this out-of-bounds read path.
Is this the same as the other GEGL Radiance HDR issues?
No. This issue is distinct from the RLE output overflow tracked as CVE-2026-2050 and the allocation overflow tracked as CVE-2026-18300.