Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
JPEG Image Can Crash gdk-pixbuf2 with Malicious File
published 6 months ago
Summary
The gdk-pixbuf2 library can crash if it's shown a malicious JPEG image. This could potentially allow an attacker to disrupt your system. Update your gdk-pixbuf2 packages to the latest version to fix this issue.
What to do
- Update almalinux gdk-pixbuf2 to version 2.42.12-4.el10_1.5.
- Update almalinux gdk-pixbuf2-devel to version 2.42.12-4.el10_1.5.
- Update almalinux gdk-pixbuf2-modules to version 2.42.12-4.el10_1.5.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| AlmaLinux:10 | almalinux | gdk-pixbuf2 |
< 2.42.12-4.el10_1.5 Fix: upgrade to 2.42.12-4.el10_1.5
|
| AlmaLinux:10 | almalinux | gdk-pixbuf2-devel |
< 2.42.12-4.el10_1.5 Fix: upgrade to 2.42.12-4.el10_1.5
|
| AlmaLinux:10 | almalinux | gdk-pixbuf2-modules |
< 2.42.12-4.el10_1.5 Fix: upgrade to 2.42.12-4.el10_1.5
|
Original advisory text
Important: gdk-pixbuf2 security update
The gdk-pixbuf2 packages provide an image loading library that can be extended by loadable modules for new image formats. It is used by toolkits such as GTK+ or clutter.
Security Fix(es):
* gdk-pixbuf: gdk-pixbuf: Denial of Service via heap-based buffer overflow when processing a specially crafted JPEG image (CVE-2026-5201)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* gdk-pixbuf: gdk-pixbuf: Denial of Service via heap-based buffer overflow when processing a specially crafted JPEG image (CVE-2026-5201)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://access.redhat.com/errata/RHSA-2026:10707 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-5201 Third Party Advisory
- https://bugzilla.redhat.com/2453291 Third Party Advisory
- https://errata.almalinux.org/10/ALSA-2026-10707.html Vendor Advisory
Timeline
Published27 Apr 2026
Updated30 Apr 2026
First seen30 Apr 2026
Sources
ALSA-2026:10707 · OSV
Track software like this
Free during beta