In GNOME GdkPixbuf (aka gdk-pixbuf) through 2.42.10, the ANI (Windows animated cursor) decoder encounters heap memory corruption (in ani_load_chunk in io-ani.c) when parsing chunks in a crafted .ani file. A crafted file could allow an attacker to overwrite heap metadata, leading to a denial of service or code execution attack. This occurs in gdk_pixbuf_set_option() in gdk-pixbuf.c.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade gdk-pixbuf2-modulesUpgrade gdk-pixbuf2-xlibUpgrade gdk-pixbuf2Upgrade gdk-pixbuf2-xlib-develUpgrade gdk-pixbuf2-devel | May 31, 2024 | Jan 26, 2024 |
| Alpine Linux | — | Upgrade gdk-pixbuf | Oct 1, 2024 | Jan 26, 2024 |
| Amazon Linux Ami 2 | — | Upgrade gdk-pixbuf2-develUpgrade gdk-pixbuf2Upgrade gdk-pixbuf2-testsUpgrade gdk-pixbuf2-debuginfo | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade gdk-pixbuf2-debuginfoUpgrade gdk-pixbuf2-devel-debuginfoUpgrade gdk-pixbuf2-modules-debuginfoUpgrade gdk-pixbuf2-testsUpgrade gdk-pixbuf2-modulesUpgrade gdk-pixbuf2-tests-debuginfoUpgrade gdk-pixbuf2-develUpgrade gdk-pixbuf2-debugsourceUpgrade gdk-pixbuf2 | Aug 5, 2025 | Jan 26, 2024 |
| Debian | — | Upgrade gdk-pixbuf | Jul 30, 2024 | Jan 26, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade gdk-pixbuf2-develUpgrade gdk-pixbuf2Upgrade gdk-pixbuf2-help | Nov 11, 2024 | Jan 26, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade gdk-pixbuf2-develUpgrade gdk-pixbuf2-modulesUpgrade gdk-pixbuf2Upgrade gdk-pixbuf2-help | Nov 26, 2024 | Jan 26, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade gdk-pixbuf2-helpUpgrade gdk-pixbuf2Upgrade gdk-pixbuf2-devel | Nov 11, 2024 | Jan 26, 2024 |
| Oracle_linux | — | Upgrade gdk-pixbuf2-xlibUpgrade gdk-pixbuf2-develUpgrade gdk-pixbuf2-modulesUpgrade gdk-pixbuf2Upgrade gdk-pixbuf2-xlib-devel | May 30, 2024 | Jan 26, 2024 |
| Redhat_linux | — | No solution existsUpgrade gdk-pixbuf2-tests-debuginfoUpgrade gdk-pixbuf2-debugsourceUpgrade gdk-pixbuf2-debuginfoUpgrade gdk-pixbuf2-modulesUpgrade gdk-pixbuf2-modules-debuginfoUpgrade gdk-pixbuf2-devel-debuginfoUpgrade gdk-pixbuf2-xlib-debuginfoUpgrade gdk-pixbuf2Upgrade gdk-pixbuf2-xlib-develUpgrade gdk-pixbuf2-develUpgrade gdk-pixbuf2-xlib | May 24, 2024 | Jan 26, 2024 |
| Rocky_linux | — | Upgrade gdk-pixbuf2-modules-debuginfoUpgrade gdk-pixbuf2-modulesUpgrade gdk-pixbuf2-xlibUpgrade gdk-pixbuf2-develUpgrade gdk-pixbuf2-debuginfoUpgrade gdk-pixbuf2-debugsourceUpgrade gdk-pixbuf2Upgrade gdk-pixbuf2-xlib-debuginfoUpgrade gdk-pixbuf2-xlib-develUpgrade gdk-pixbuf2-devel-debuginfo | Jun 17, 2024 | Jan 26, 2024 |
| Suse | — | Upgrade typelib-1_0-GdkPixbuf-2_0Upgrade gdk-pixbuf-develUpgrade gdk-pixbuf-thumbnailerUpgrade gdk-pixbuf-langUpgrade gdk-pixbuf-query-loadersUpgrade gdk-pixbuf-query-loaders-32bitUpgrade libgdk_pixbuf-2_0-0Upgrade gdk-pixbuf-devel-32bitUpgrade typelib-1_0-GdkPixdata-2_0Upgrade libgdk_pixbuf-2_0-0-32bit | Aug 9, 2024 | Jan 26, 2024 |
| Ubuntu | — | Upgrade libgdk-pixbuf2.0-0Upgrade libgdk-pixbuf-2.0-0Upgrade libgdk-pixbuf2.0-0 (Ubuntu Pro) | Jun 7, 2024 | Jan 26, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub