CVE-2026-5201: Gdk-pixbuf: gdk-pixbuf: denial of service via heap-based buffer overflow when processing a specially crafted jpeg image
A flaw was found in the gdk-pixbuf library. This heap-based buffer overflow vulnerability occurs in the JPEG image loader due to improper validation of color component counts when processing a specially crafted JPEG image. A remote attacker can exploit this flaw without user interaction, for example, via thumbnail generation. Successful exploitation leads to application crashes and denial of service (DoS) conditions.
Other sources
Gdk-pixbuf: gdk-pixbuf: denial of service via heap-based buffer overflow when processing a specially crafted jpeg image
— Microsoft
Heap-Based Buffer Overflow vulnerability in the JPEG image loader of the gdk-pixbuf library. The flaw is caused by improper validation of color component counts in the gdkpixbufjpegimageload() function, leading to insufficient memory allocation for pixel data. When a specially crafted JPEG image is processed, libjpeg writes more data than allocated, resulting in a heap buffer overflow. This can be triggered automatically via thumbnail generation without user interaction, causing application crashes and denial-of-service conditions. Claims of code execution are not reliably substantiated and require unrealistic conditions; however, the memory corruption and crash impact are confirmed with high confidence.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/gdk-pixbufto a version that resolves this vulnerability.Fixed in 2.42.2+dfsg-1+deb11u5Fixed in 2.42.10+dfsg-1+deb12u4Fixed in 2.42.12+dfsg-4+deb13u1Fixed in 2.44.6+dfsg-2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.42.10-5
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5201?
CVE-2026-5201 is classified as a critical severity vulnerability due to its potential to cause a denial of service through a heap-based buffer overflow.
How do I fix CVE-2026-5201?
Fixing CVE-2026-5201 requires updating the gdk-pixbuf library to a version that has addressed the heap-based buffer overflow vulnerability.
Which software is affected by CVE-2026-5201?
CVE-2026-5201 affects the gdk-pixbuf library used in GNOME applications.
What type of attack does CVE-2026-5201 enable?
CVE-2026-5201 enables a denial of service attack by exploiting the heap-based buffer overflow when processing specially crafted JPEG images.
Is there a workaround for CVE-2026-5201?
Currently, the best approach for CVE-2026-5201 is to apply the available software updates as there are no reliable workarounds that eliminate the risk.