CVE-2021-46829
HIGH 7.8EPSS 0.8%
GNOME GdkPixbuf (aka GDK-PixBuf) before 2.42.8 allows a heap-based buffer overflow when compositing or clearing frames in GIF files, as demonstrated by io-gif-animation.c composite_frame. This overflow is controllable and could be abused for code execution, especially on 32-bit systems.
- CVSS v3.1 NVD
- 7.8 HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - EPSS
- 0.80% chance of exploitation in the next 30 days, 56th percentile
- Published
- 2022-07-24
- Updated
- 2024-08-04
Proof-of-concept exploits (2)
- pedrib/PoC/blob/master/fuzzing/CVE-2021-46829/CVE-2021-46829.md862★ · 2025-04-16
- https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/190
Security advisories
- http://www.openwall.com/lists/oss-security/2022/07/25/1
- https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/commit/5398f04d772f7f8baf5265715696ed88db0f05…
- https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/commit/bca00032ad68d0b0aa2c1f7558db931e52bd9c…
- https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/merge_requests/121
- https://www.debian.org/security/2022/dsa-5228
- https://www.openwall.com/lists/oss-security/2022/07/23/1