In GNOME GdkPixbuf (aka gdk-pixbuf) through 2.42.10, the ANI (Windows animated cursor) decoder encounters heap memory corruption (in ani_load_chunk in io-ani.c) when parsing chunks in a crafted .ani file. A crafted file could allow an attacker to overwrite heap metadata, leading to a denial of service or code execution attack. This occurs in gdk_pixbuf_set_option() in gdk-pixbuf.c.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade gdk-pixbuf2-modulesUpgrade gdk-pixbuf2-xlibUpgrade gdk-pixbuf2-develUpgrade gdk-pixbuf2Upgrade gdk-pixbuf2-xlib-devel | May 31, 2024 | Jan 26, 2024 |
| Alpine Linux | — | Upgrade gdk-pixbuf | Oct 1, 2024 | Jan 26, 2024 |
| Amazon Linux Ami 2 | — | Upgrade gdk-pixbuf2Upgrade gdk-pixbuf2-testsUpgrade gdk-pixbuf2-debuginfoUpgrade gdk-pixbuf2-devel | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade gdk-pixbuf2-debuginfoUpgrade gdk-pixbuf2-devel-debuginfoUpgrade gdk-pixbuf2-modules-debuginfoUpgrade gdk-pixbuf2Upgrade gdk-pixbuf2-tests-debuginfoUpgrade gdk-pixbuf2-debugsourceUpgrade gdk-pixbuf2-testsUpgrade gdk-pixbuf2-develUpgrade gdk-pixbuf2-modules | Aug 5, 2025 | Jan 26, 2024 |
| Debian | — | Upgrade gdk-pixbuf | Jul 30, 2024 | Jan 26, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade gdk-pixbuf2-develUpgrade gdk-pixbuf2-helpUpgrade gdk-pixbuf2 | Nov 11, 2024 | Jan 26, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade gdk-pixbuf2-develUpgrade gdk-pixbuf2Upgrade gdk-pixbuf2-modulesUpgrade gdk-pixbuf2-help | Nov 26, 2024 | Jan 26, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade gdk-pixbuf2-develUpgrade gdk-pixbuf2Upgrade gdk-pixbuf2-help | Nov 11, 2024 | Jan 26, 2024 |
| Oracle_linux | — | Upgrade gdk-pixbuf2-develUpgrade gdk-pixbuf2-modulesUpgrade gdk-pixbuf2-xlibUpgrade gdk-pixbuf2Upgrade gdk-pixbuf2-xlib-devel | May 30, 2024 | Jan 26, 2024 |
| Redhat_linux | — | Upgrade gdk-pixbuf2-xlibUpgrade gdk-pixbuf2-devel-debuginfoUpgrade gdk-pixbuf2-modules-debuginfoUpgrade gdk-pixbuf2Upgrade gdk-pixbuf2-develUpgrade gdk-pixbuf2-xlib-debuginfoUpgrade gdk-pixbuf2-xlib-develUpgrade gdk-pixbuf2-tests-debuginfoUpgrade gdk-pixbuf2-debugsourceUpgrade gdk-pixbuf2-debuginfoNo solution existsUpgrade gdk-pixbuf2-modules | May 24, 2024 | Jan 26, 2024 |
| Rocky_linux | — | Upgrade gdk-pixbuf2-xlib-debuginfoUpgrade gdk-pixbuf2-devel-debuginfoUpgrade gdk-pixbuf2Upgrade gdk-pixbuf2-xlib-develUpgrade gdk-pixbuf2-debugsourceUpgrade gdk-pixbuf2-xlibUpgrade gdk-pixbuf2-modules-debuginfoUpgrade gdk-pixbuf2-modulesUpgrade gdk-pixbuf2-debuginfoUpgrade gdk-pixbuf2-devel | Jun 17, 2024 | Jan 26, 2024 |
| Suse | — | Upgrade gdk-pixbuf-develUpgrade libgdk_pixbuf-2_0-0Upgrade gdk-pixbuf-thumbnailerUpgrade gdk-pixbuf-query-loadersUpgrade gdk-pixbuf-query-loaders-32bitUpgrade gdk-pixbuf-langUpgrade libgdk_pixbuf-2_0-0-32bitUpgrade typelib-1_0-gdkpixdata-2_0Upgrade gdk-pixbuf-devel-32bitUpgrade typelib-1_0-gdkpixbuf-2_0 | Aug 9, 2024 | Jan 26, 2024 |
| Ubuntu | — | Upgrade libgdk-pixbuf2.0-0Upgrade libgdk-pixbuf2.0-0 (Ubuntu Pro)Upgrade libgdk-pixbuf-2.0-0 | Jun 7, 2024 | Jan 26, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub