Skip to main content
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Deliver malicious JPEG
  2. Delivery
    Trigger automatic thumbnail generation
  3. Exploit
    Exploit heap overflow in JPEG decoder
  4. Execution
    Crash gdk-pixbuf process
  5. Impact
    Deny service to image processing functions

Vulnerability Assessment

Weakness
CWE
CWE-122
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires the victim system to process a specially crafted JPEG image through gdk-pixbuf's JPEG loader. This occurs automatically during thumbnail generation when browsing directories with image files in GNOME file managers, when email clients render attachment previews, or when web browsers process JPEG content using gdk-pixbuf. No user interaction beyond normal system operation is required (UI:N in CVSS vector). The vulnerability affects default configurations of Red Hat Enterprise Linux desktop and server installations with gdk-pixbuf installed-no special configuration or non-default features need to be enabled. However, exploitation is limited to systems that actively process JPEG images from untrusted sources. Server installations without graphical desktop environments or image processing services are not exposed. The unauthenticated network attack vector (AV:N/PR:N) means any attacker who can deliver a malicious JPEG to a vulnerable system can trigger the flaw, whether through web content, email, file shares, or USB media containing malicious images.
Impact

Real-world risk is moderate despite the 7.5 CVSS score. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates easy network-based exploitation without authentication or user interaction, earning the high score. However, multiple risk signals provide important context: EPSS score of 0.09% (25th percentile) indicates extremely low probability of exploitation in the wild, suggesting attackers are not actively targeting this flaw. SSVC framework confirms no active exploitation (Exploitation: none) but notes the vulnerability is fully automatable and causes partial technical impact (denial of service only, no code execution). The discrepancy between theoretical severity (network-accessible, no auth required) and observed exploitation (near-zero) likely reflects limited attacker interest in DoS-only outcomes versus more lucrative code execution vulnerabilities. Primary risk scenarios involve automated image processing systems (thumbnail generators, email attachment scanners, content management platforms) where malicious JPEG uploads could trigger service disruptions. Organizations using Red Hat Enterprise Linux for desktop or server environments with image processing should prioritize patching based on exposure to untrusted image sources rather than CVSS score alone.
Exploit ScenarioDerived

An attacker crafts a malicious JPEG image with invalid color component counts in the file header and hosts it on a website or embeds it in an email attachment. When a victim using a vulnerable Red Hat Enterprise Linux system browses a directory containing the malicious JPEG, the GNOME Nautilus file manager automatically attempts to generate a thumbnail preview without user interaction. The gdk-pixbuf JPEG decoder processes the malformed image, triggering the heap buffer overflow and causing the file manager process to crash. The attack succeeds without authentication or user clicks beyond normal file browsing operations. No public exploit identified at time of analysis, though the low attack complexity (AC:L) suggests straightforward weaponization is possible.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv7 – Apr 30, 2026

Heap-based buffer overflow in gdk-pixbuf's JPEG image loader enables remote denial of service through malformed JPEG images without user interaction. The vulnerability triggers during automated image processing operations like thumbnail generation across Red Hat Enterprise Linux 6 through 10, allowing unauthenticated network attackers to crash applications that process JPEG images. EPSS score of 0.09% (25th percentile) suggests low observed exploitation activity, consistent with SSVC assessment showing no active exploitation despite the vulnerability being fully automatable.

Earlier versions of this analysis (6)
v6 Apr 30, 2026 - 06:28 cvss changed CVSS 7.5

Heap-based buffer overflow in gdk-pixbuf JPEG image loader allows remote unauthenticated denial of service without user interaction. The vulnerability triggers during automatic thumbnail generation or other background image processing tasks across Red Hat Enterprise Linux versions 6-10. EPSS exploitation probability is low (0.09%, 25th percentile) with no public exploit identified at time of analysis, but the vulnerability is automatable per SSVC framework. Vendor patches are available across all affected RHEL versions.

v5 Apr 28, 2026 - 09:28 cvss changed CVSS 7.5

Heap-based buffer overflow in gdk-pixbuf's JPEG image loader crashes applications during automated thumbnail processing of malicious images. Remote unauthenticated attackers can trigger denial of service without user interaction by delivering crafted JPEG files to systems performing automated image processing (email attachments, file browsers, web content indexing). EPSS score of 0.09% suggests low widespread exploitation probability despite the network-exploitable attack vector. No active exploitation confirmed (not in CISA KEV). Vendor patches released across Red Hat Enterprise Linux 6-10 per multiple RHSA advisories.

v4 Apr 28, 2026 - 08:28 cvss changed CVSS 7.5

Heap-based buffer overflow in gdk-pixbuf's JPEG image loader allows remote unauthenticated denial of service via maliciously crafted JPEG images. The vulnerability triggers during automated image processing operations like thumbnail generation, requiring no user interaction, affecting Red Hat Enterprise Linux versions 6 through 10. Despite network-accessible attack vector and low complexity (CVSS 7.5), no public exploit identified at time of analysis and EPSS score of 0.09% (25th percentile) indicates low observed exploitation probability, consistent with SSVC assessment showing no active exploitation and partial technical impact limited to availability.

v3 Apr 27, 2026 - 10:27 cvss changed CVSS 7.5

Heap-based buffer overflow in gdk-pixbuf JPEG loader allows remote unauthenticated denial of service through maliciously crafted JPEG images. The vulnerability triggers during automated processing scenarios like thumbnail generation, requiring no user interaction (AV:N/PR:N/UI:N). While CVSS rates this 7.5 HIGH, real-world risk remains moderate: EPSS exploitation probability is low at 0.09% (25th percentile), no active exploitation is confirmed (SSVC: exploitation=none), and vendor patches are available across Red Hat Enterprise Linux versions 6-10. Impact is limited to application crashes without data confidentiality or integrity compromise.

v2 Apr 27, 2026 - 03:27 cvss changed CVSS 7.5

Heap-based buffer overflow in gdk-pixbuf's JPEG loader allows remote denial of service through automated processing of crafted images. The flaw triggers when applications automatically handle JPEG files (e.g., thumbnail generation, image preview) without user interaction, causing crashes across Red Hat Enterprise Linux distributions (RHEL 6-10). EPSS score of 0.09% (25th percentile) indicates low observed exploitation probability despite network-accessible attack vector. No active exploitation confirmed (not in CISA KEV), and vendor patches are available per Red Hat advisory RHSA-2026:10708.

v1 Mar 31, 2026 - 08:45 CVSS 7.5

Heap-based buffer overflow in gdk-pixbuf JPEG loader allows unauthenticated remote attackers to trigger denial of service through specially crafted JPEG images without user interaction. The vulnerability affects Red Hat Enterprise Linux versions 6 through 10 and can be triggered automatically during thumbnail generation operations. With CVSS 7.5 (High) and network-accessible attack vector, this poses significant availability risk. No public exploit identified at time of analysis, though EPSS data not available for final risk quantification.

RemediationAI

Apply vendor-released security updates immediately for affected Red Hat Enterprise Linux systems. Red Hat has published multiple security advisories with patches: RHSA-2026:10707, RHSA-2026:10708, RHSA-2026:10741, RHSA-2026:11325, RHSA-2026:11326, RHSA-2026:11327, RHSA-2026:11328, RHSA-2026:11806, and RHSA-2026:12060 covering RHEL 6 through 10 (access.redhat.com/errata). Debian LTS users should follow guidance at lists.debian.org/debian-lts-announce/2026/04/msg00010.html. For systems where immediate patching is not feasible, implement compensating controls by restricting JPEG image processing to trusted sources only. Disable automatic thumbnail generation for untrusted content in file managers and email clients by modifying GNOME settings or application configurations-note this degrades user experience by removing image previews. For web-facing services accepting image uploads, deploy content validation proxies that sanitize JPEG files before processing, though this adds processing overhead and may not catch all malformed inputs. Network segmentation can limit blast radius by isolating image processing services from critical infrastructure, reducing denial-of-service impact scope.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

gdk-pixbuf is the GNOME image loading library used throughout Linux desktop environments for rendering image formats including JPEG, PNG, and GIF. This CWE-122 heap-based buffer overflow occurs in the JPEG decoder's color component validation logic. When parsing JPEG image headers, the library fails to properly bounds-check the number of color components declared in a malicious JPEG file before allocating heap memory. This allows crafted JPEG images to specify component counts that exceed allocated buffer sizes, triggering heap corruption during the image decoding process. The vulnerability affects all Red Hat Enterprise Linux versions from RHEL 6 through RHEL 10, indicating widespread deployment across enterprise Linux environments where gdk-pixbuf serves as a critical dependency for desktop applications, file managers, email clients, web browsers, and any software rendering image thumbnails or previews.

Know when Red Hat Enterprise Linux 10 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SUSE HIGH
Red Hat 7.5 HIGH

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

8
Analysis Updated
Apr 30, 2026 - 08:28 vuln.today
v7 - CVSS changed
Analysis Updated
Apr 30, 2026 - 06:28 vuln.today
v6 - CVSS changed
Analysis Updated
Apr 28, 2026 - 09:28 vuln.today
v5 - CVSS changed
Analysis Updated
Apr 28, 2026 - 08:28 vuln.today
v4 - CVSS changed
Analysis Updated
Apr 27, 2026 - 10:27 vuln.today
v3 - CVSS changed
Analysis Updated
Apr 27, 2026 - 03:27 vuln.today
v2 - CVSS changed
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
CVE Published
Mar 31, 2026 - 08:32 nvd
HIGH 7.5

DescriptionCVE.org

A flaw was found in the gdk-pixbuf library. This heap-based buffer overflow vulnerability occurs in the JPEG image loader due to improper validation of color component counts when processing a specially crafted JPEG image. A remote attacker can exploit this flaw without user interaction, for example, via thumbnail generation. Successful exploitation leads to application crashes and denial of service (DoS) conditions.

Executive ViewAI

Why It Matters

CVE-2026-5201 is a heap buffer overflow in gdk-pixbuf's JPEG image loader affecting Red Hat Enterprise Linux 6-10, allowing unauthenticated attackers to remotely crash applications that process JPEG images without user interaction. Organizations running vulnerable Linux distributions with automated image processing workflows (thumbnail generation, automated document processing) face denial-of-service risk to dependent services. The low EPSS score (0.1%) indicates minimal current threat activity, but the ease of exploitation and broad platform reach warrant timely patching.

Business Impact: Medium
Compensating Controls

Apply vendor patch. If immediate patching is delayed: (1) restrict JPEG processing to trusted image sources only; (2) implement network-level filtering to block suspicious JPEG uploads; (3) isolate image processing services in containers with resource limits to prevent full system impact; (4) monitor application logs for unexpected crashes during image handling operations.

Threat Intelligence Overview

EPSS Score
0.1%
Top 75% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
Medium
Technical Impact
Partial

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Heap Overflow HIGH

A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Affected Products (CPE)CVE.org

cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-101258 HIGH POC
7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
CVE-2026-96889 HIGH POC
7.8 Sep 23

Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
CVE-2026-4775 HIGH POC
7.8 Mar 24

A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to

CVE-2026-114406 MEDIUM POC
6.8 Oct 21

The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-102560 CRITICAL
9.8 Sep 29

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe

Same weakness CWE-122 – Heap-based Buffer Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2023-27997 CRITICAL
9.8
CVE-2026-94127 CRITICAL POC
9.3
CVE-2025-25249 CRITICAL POC
9.8
CVE-2026-85880 HIGH POC
7.8
CVE-2025-24985 HIGH POC
7.8
CVE-2026-53362 HIGH POC
7.8
CVE-2025-21418 HIGH
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Micro 5.2 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-5201 ADVISORY https://vuldb.com/vuln/354334 REF https://access.redhat.com/errata/RHSA-2026:10707 REF https://access.redhat.com/errata/RHSA-2026:10708 REF https://access.redhat.com/errata/RHSA-2026:10741 REF https://access.redhat.com/errata/RHSA-2026:11325 REF https://access.redhat.com/errata/RHSA-2026:11326 REF https://access.redhat.com/errata/RHSA-2026:11327 REF https://access.redhat.com/errata/RHSA-2026:11328 REF https://access.redhat.com/errata/RHSA-2026:11806 REF https://access.redhat.com/errata/RHSA-2026:12060 REF https://access.redhat.com/errata/RHSA-2026:12061 REF https://access.redhat.com/errata/RHSA-2026:12062 REF https://access.redhat.com/errata/RHSA-2026:12114 REF https://access.redhat.com/errata/RHSA-2026:12115 REF https://access.redhat.com/errata/RHSA-2026:16008 REF https://access.redhat.com/errata/RHSA-2026:16009 REF https://access.redhat.com/errata/RHSA-2026:16030 REF https://access.redhat.com/errata/RHSA-2026:16174 REF https://access.redhat.com/errata/RHSA-2026:19127 REF https://access.redhat.com/errata/RHSA-2026:19210 REF https://access.redhat.com/errata/RHSA-2026:19724 REF https://access.redhat.com/errata/RHSA-2026:19725 REF https://access.redhat.com/errata/RHSA-2026:25096 REF https://access.redhat.com/security/cve/CVE-2026-5201 REF https://bugzilla.redhat.com/show_bug.cgi?id=2453291 REF https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/304 REF https://lists.debian.org/debian-lts-announce/2026/04/msg00010.html REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5201.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy