In GNOME GdkPixbuf (aka gdk-pixbuf) through 2.42.10, the ANI (Windows animated cursor) decoder encounters heap memory corruption (in ani_load_chunk in io-ani.c) when parsing chunks in a crafted .ani file. A crafted file could allow an attacker to overwrite heap metadata, leading to a denial of service or code execution attack. This occurs in gdk_pixbuf_set_option() in gdk-pixbuf.c.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade gdk-pixbuf2-develUpgrade gdk-pixbuf2Upgrade gdk-pixbuf2-xlib-develUpgrade gdk-pixbuf2-modulesUpgrade gdk-pixbuf2-xlib | May 31, 2024 | Jan 26, 2024 |
| Alpine Linux | — | Upgrade gdk-pixbuf | Oct 1, 2024 | Jan 26, 2024 |
| Amazon Linux Ami 2 | — | Upgrade gdk-pixbuf2-debuginfoUpgrade gdk-pixbuf2Upgrade gdk-pixbuf2-testsUpgrade gdk-pixbuf2-devel | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade gdk-pixbuf2-modules-debuginfoUpgrade gdk-pixbuf2-debuginfoUpgrade gdk-pixbuf2-devel-debuginfoUpgrade gdk-pixbuf2-modulesUpgrade gdk-pixbuf2-develUpgrade gdk-pixbuf2Upgrade gdk-pixbuf2-debugsourceUpgrade gdk-pixbuf2-testsUpgrade gdk-pixbuf2-tests-debuginfo | Aug 5, 2025 | Jan 26, 2024 |
| Debian | — | Upgrade gdk-pixbuf | Jul 30, 2024 | Jan 26, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade gdk-pixbuf2Upgrade gdk-pixbuf2-helpUpgrade gdk-pixbuf2-devel | Nov 11, 2024 | Jan 26, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade gdk-pixbuf2-helpUpgrade gdk-pixbuf2Upgrade gdk-pixbuf2-develUpgrade gdk-pixbuf2-modules | Nov 26, 2024 | Jan 26, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade gdk-pixbuf2-develUpgrade gdk-pixbuf2-helpUpgrade gdk-pixbuf2 | Nov 11, 2024 | Jan 26, 2024 |
| Oracle_linux | — | Upgrade gdk-pixbuf2-modulesUpgrade gdk-pixbuf2-develUpgrade gdk-pixbuf2-xlibUpgrade gdk-pixbuf2Upgrade gdk-pixbuf2-xlib-devel | May 30, 2024 | Jan 26, 2024 |
| Redhat_linux | — | Upgrade gdk-pixbuf2Upgrade gdk-pixbuf2-develUpgrade gdk-pixbuf2-xlib-debuginfoUpgrade gdk-pixbuf2-xlib-develUpgrade gdk-pixbuf2-devel-debuginfoUpgrade gdk-pixbuf2-modules-debuginfoUpgrade gdk-pixbuf2-xlibUpgrade gdk-pixbuf2-debugsourceNo solution existsUpgrade gdk-pixbuf2-debuginfoUpgrade gdk-pixbuf2-modulesUpgrade gdk-pixbuf2-tests-debuginfo | May 24, 2024 | Jan 26, 2024 |
| Rocky_linux | — | Upgrade gdk-pixbuf2-debuginfoUpgrade gdk-pixbuf2-xlibUpgrade gdk-pixbuf2-develUpgrade gdk-pixbuf2-modulesUpgrade gdk-pixbuf2-modules-debuginfoUpgrade gdk-pixbuf2-devel-debuginfoUpgrade gdk-pixbuf2-debugsourceUpgrade gdk-pixbuf2-xlib-develUpgrade gdk-pixbuf2Upgrade gdk-pixbuf2-xlib-debuginfo | Jun 17, 2024 | Jan 26, 2024 |
| Suse | — | Upgrade libgdk_pixbuf-2_0-0-32bitUpgrade typelib-1_0-GdkPixdata-2_0Upgrade gdk-pixbuf-devel-32bitUpgrade gdk-pixbuf-query-loaders-32bitUpgrade typelib-1_0-GdkPixbuf-2_0Upgrade gdk-pixbuf-develUpgrade gdk-pixbuf-langUpgrade gdk-pixbuf-thumbnailerUpgrade libgdk_pixbuf-2_0-0Upgrade gdk-pixbuf-query-loaders | Aug 9, 2024 | Jan 26, 2024 |
| Ubuntu | — | Upgrade libgdk-pixbuf2.0-0Upgrade libgdk-pixbuf2.0-0 (Ubuntu Pro)Upgrade libgdk-pixbuf-2.0-0 | Jun 7, 2024 | Jan 26, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub