REDHAT-BUG-2544420: Medium severity GEGL GEGL vulnerability
A flaw was found in GEGL's Radiance HDR (RGBE) image loader. rgbereaduncompressed() reads xaxis.size times 4 bytes from the memory-mapped file for every scanline and does not compare that length with the bytes remaining in the file. rgbergbetofloat() then loads those bytes. A crafted .hdr file whose declared image is larger than its scanline data can make the application that opens it crash. The pixel buffer is sized for the declared image, so this path is a read past the file mapping. It is distinct from the RLE output overflow tracked as CVE-2026-2050 and from the allocation overflow tracked as CVE-2026-18300: a height below the 32768-pixel cap still reaches the unbounded read.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs to provide a crafted Radiance HDR (.hdr) file whose declared image dimensions require more uncompressed scanline data than the file contains, and have an application using GEGL open that file.
What is the likely impact?
Opening the malformed file can cause the application to crash because GEGL reads beyond the memory-mapped file while processing uncompressed RGBE scanlines.
Are files below the 32768-pixel height cap still affected?
Yes. The unbounded read can be reached with an image height below the 32768-pixel cap; that cap does not prevent this issue.
Is this the same issue as the referenced CVE-2026-2050?
No. This is distinct from the RLE output overflow tracked as CVE-2026-2050 and from the allocation overflow tracked as CVE-2026-18300.