CVE-2026-5201
Gdk-pixbuf: gdk-pixbuf: denial of service via heap-based buffer overflow when processing a specially crafted jpeg image
HIGH 7.5EPSS 1.2%
A flaw was found in the gdk-pixbuf library. This heap-based buffer overflow vulnerability occurs in the JPEG image loader due to improper validation of color component counts when processing a specially crafted JPEG image. A remote attacker can exploit this flaw without user interaction, for example, via thumbnail generation. Successful exploitation leads to application crashes and denial of service (DoS) conditions.
- Affected
- Red Hat · Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 10.0 Extended Update Support · Red Hat Enterprise Linux 7 Extended Lifecycle Support · Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 8.2 Advanced Update Support · Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
- CVSS v3.1 CNA
- 7.5 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - EPSS
- 1.22% chance of exploitation in the next 30 days, 68th percentile
- Published
- 2026-03-31
- Updated
- 2026-07-15
Proof-of-concept exploits (1)
- kagancapar/CVE-2026-520113★ · 2026-08-10
Security advisories
- https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/304
- https://access.redhat.com/errata/RHSA-2026:10707
- https://access.redhat.com/errata/RHSA-2026:10708
- https://access.redhat.com/errata/RHSA-2026:10741
- https://access.redhat.com/errata/RHSA-2026:11325
- https://access.redhat.com/errata/RHSA-2026:11326
- https://access.redhat.com/errata/RHSA-2026:11327
- https://access.redhat.com/errata/RHSA-2026:11328
- https://access.redhat.com/errata/RHSA-2026:11806
- https://access.redhat.com/errata/RHSA-2026:12060
- https://access.redhat.com/errata/RHSA-2026:12061
- https://access.redhat.com/errata/RHSA-2026:12062
- https://access.redhat.com/errata/RHSA-2026:12114
- https://access.redhat.com/errata/RHSA-2026:12115
- https://access.redhat.com/security/cve/CVE-2026-5201
- https://bugzilla.redhat.com/show_bug.cgi?id=2453291
- https://lists.debian.org/debian-lts-announce/2026/04/msg00010.html