EUVD-2026-67217
GHSA-237w-6c39-25rh
Severity by source
AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
Local vector because malicious file must be opened locally; AC:H for heap-layout dependency; PR:N and UI:R because no privilege needed but user must open the file; availability-only impact confirmed by description.
Primary rating from Vendor (redhat).
CVSS VectorNVD
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
Lifecycle Timeline
2DescriptionNVD
A flaw was found in gdk-pixbuf. When loading a specially crafted JPEG image containing chunked ICC profile markers, an error during ICC profile parsing can leave stale size metadata after the profile buffer is freed. A subsequent allocation in the same decode can cause an out-of-bounds write, potentially crashing the application. To exploit this flaw, an application using gdk-pixbuf must process the malicious JPEG image.
Affected version >= 2.26.4
AnalysisAI
Out-of-bounds write in gdk-pixbuf's JPEG decoder affects any application on Red Hat Enterprise Linux 6 through 10 that renders JPEG images containing chunked ICC profile markers. When ICC profile parsing encounters an error, stale size metadata persists after the profile buffer is freed; a subsequent allocation within the same decode operation then writes beyond buffer boundaries, crashing the application. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that a user or automated process opens a specially crafted JPEG file using an application that relies on gdk-pixbuf for image decoding - this is the non-negotiable trigger condition. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 4.7 (Medium) reflects a constrained threat profile: AV:L indicates the malicious JPEG must be accessible locally, AC:H signals that specific memory layout conditions must align for the write to land harmfully, UI:R requires a user to actively open the file, and the impact is limited entirely to Availability (A:H) with no confidentiality or integrity effect. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a malicious JPEG file embedding specially structured chunked ICC profile markers that trigger the error path in gdk-pixbuf's ICC reassembly logic, then delivers the file to a target via email attachment, web download, or a shared network folder. When a victim on an affected RHEL system opens the file in any gdk-pixbuf-linked application - such as an image viewer, the Nautilus file manager generating a thumbnail, or a GTK-based application - the out-of-bounds write occurs, crashing the application. … |
| Remediation | An upstream fix is available via GNOME GitLab commit efe658674bd103d1c9bf50809d5767a3f6dd5a01 and merge request 278 (https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/merge_requests/278); however, a specific tagged release version incorporating this fix has not been independently confirmed from the available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Denial of service in Red Hat / 389 Directory Server (389-ds-base, versions since ~1.3.2/2013) allows an authenticated LD
Local-to-domain-wide root privilege escalation in SSSD's LDAP sudo provider allows an authenticated LDAP directory user
Heap buffer overflow in GStreamer's librfb (RFB/VNC client) allows a malicious VNC server to corrupt heap memory on a co
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today