Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

gdk-pixbuf2: Denial of Service from Malicious JPEG Images

published 6 months ago

Summary

A security update is available for gdk-pixbuf2, which is used by some software to load images. This update fixes a bug that could allow an attacker to crash the application by sending a specially crafted JPEG image. Update your software to fix this issue.

What to do

Update rocky gdk-pixbuf2 to version 0:2.42.6-6.el9_7.1.

Affected software

Ecosystem	Vendor	Product	Affected versions
Rocky Linux:9	rocky	gdk-pixbuf2	< 0:2.42.6-6.el9_7.1 Fix: upgrade to 0:2.42.6-6.el9_7.1

Original advisory text

Important: gdk-pixbuf2 security update

The gdk-pixbuf2 packages provide an image loading library that can be extended by loadable modules for new image formats. It is used by toolkits such as GTK+ or clutter.

Security Fix(es):

* gdk-pixbuf: gdk-pixbuf: Denial of Service via heap-based buffer overflow when processing a specially crafted JPEG image (CVE-2026-5201)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

https://errata.rockylinux.org/RLSA-2026:10708 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2453291 Third Party Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Timeline

Published28 Apr 2026

Updated28 Apr 2026

First seen28 Apr 2026

Sources

RLSA-2026:10708 · OSV

Track software like this

Free during beta