In GNOME GdkPixbuf (aka gdk-pixbuf) through 2.42.10, the ANI (Windows animated cursor) decoder encounters heap memory corruption (in ani_load_chunk in io-ani.c) when parsing chunks in a crafted .ani file. A crafted file could allow an attacker to overwrite heap metadata, leading to a denial of service or code execution attack. This occurs in gdk_pixbuf_set_option() in gdk-pixbuf.c.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade gdk-pixbuf2-xlib-develUpgrade gdk-pixbuf2-develUpgrade gdk-pixbuf2Upgrade gdk-pixbuf2-modulesUpgrade gdk-pixbuf2-xlib | May 31, 2024 | Jan 26, 2024 |
| Alpine Linux | — | Upgrade gdk-pixbuf | Oct 1, 2024 | Jan 26, 2024 |
| Amazon Linux Ami 2 | — | Upgrade gdk-pixbuf2-debuginfoUpgrade gdk-pixbuf2Upgrade gdk-pixbuf2-testsUpgrade gdk-pixbuf2-devel | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade gdk-pixbuf2-debuginfoUpgrade gdk-pixbuf2-modules-debuginfoUpgrade gdk-pixbuf2-devel-debuginfoUpgrade gdk-pixbuf2-develUpgrade gdk-pixbuf2-modulesUpgrade gdk-pixbuf2-testsUpgrade gdk-pixbuf2-tests-debuginfoUpgrade gdk-pixbuf2-debugsourceUpgrade gdk-pixbuf2 | Aug 5, 2025 | Jan 26, 2024 |
| Debian | — | Upgrade gdk-pixbuf | Jul 30, 2024 | Jan 26, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade gdk-pixbuf2-helpUpgrade gdk-pixbuf2Upgrade gdk-pixbuf2-devel | Nov 11, 2024 | Jan 26, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade gdk-pixbuf2Upgrade gdk-pixbuf2-develUpgrade gdk-pixbuf2-modulesUpgrade gdk-pixbuf2-help | Nov 26, 2024 | Jan 26, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade gdk-pixbuf2Upgrade gdk-pixbuf2-helpUpgrade gdk-pixbuf2-devel | Nov 11, 2024 | Jan 26, 2024 |
| Oracle_linux | — | Upgrade gdk-pixbuf2-modulesUpgrade gdk-pixbuf2-develUpgrade gdk-pixbuf2-xlibUpgrade gdk-pixbuf2Upgrade gdk-pixbuf2-xlib-devel | May 30, 2024 | Jan 26, 2024 |
| Redhat_linux | — | Upgrade gdk-pixbuf2-tests-debuginfoUpgrade gdk-pixbuf2-modulesUpgrade gdk-pixbuf2-debuginfoUpgrade gdk-pixbuf2-debugsourceNo solution existsUpgrade gdk-pixbuf2-xlibUpgrade gdk-pixbuf2-devel-debuginfoUpgrade gdk-pixbuf2-xlib-debuginfoUpgrade gdk-pixbuf2-develUpgrade gdk-pixbuf2Upgrade gdk-pixbuf2-modules-debuginfoUpgrade gdk-pixbuf2-xlib-devel | May 24, 2024 | Jan 26, 2024 |
| Rocky_linux | — | Upgrade gdk-pixbuf2-modulesUpgrade gdk-pixbuf2-modules-debuginfoUpgrade gdk-pixbuf2-debuginfoUpgrade gdk-pixbuf2-xlibUpgrade gdk-pixbuf2-develUpgrade gdk-pixbuf2Upgrade gdk-pixbuf2-xlib-debuginfoUpgrade gdk-pixbuf2-xlib-develUpgrade gdk-pixbuf2-debugsourceUpgrade gdk-pixbuf2-devel-debuginfo | Jun 17, 2024 | Jan 26, 2024 |
| Suse | — | Upgrade gdk-pixbuf-query-loadersUpgrade libgdk_pixbuf-2_0-0Upgrade gdk-pixbuf-query-loaders-32bitUpgrade gdk-pixbuf-thumbnailerUpgrade gdk-pixbuf-develUpgrade gdk-pixbuf-langUpgrade typelib-1_0-gdkpixbuf-2_0Upgrade gdk-pixbuf-devel-32bitUpgrade libgdk_pixbuf-2_0-0-32bitUpgrade typelib-1_0-gdkpixdata-2_0 | Aug 9, 2024 | Jan 26, 2024 |
| Ubuntu | — | Upgrade libgdk-pixbuf2.0-0Upgrade libgdk-pixbuf2.0-0 (Ubuntu Pro)Upgrade libgdk-pixbuf-2.0-0 | Jun 7, 2024 | Jan 26, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub