In GNOME GdkPixbuf (aka gdk-pixbuf) through 2.42.10, the ANI (Windows animated cursor) decoder encounters heap memory corruption (in ani_load_chunk in io-ani.c) when parsing chunks in a crafted .ani file. A crafted file could allow an attacker to overwrite heap metadata, leading to a denial of service or code execution attack. This occurs in gdk_pixbuf_set_option() in gdk-pixbuf.c.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade gdk-pixbuf2-xlib-develUpgrade gdk-pixbuf2Upgrade gdk-pixbuf2-develUpgrade gdk-pixbuf2-xlibUpgrade gdk-pixbuf2-modules | May 31, 2024 | Jan 26, 2024 |
| Alpine Linux | — | Upgrade gdk-pixbuf | Oct 1, 2024 | Jan 26, 2024 |
| Amazon Linux Ami 2 | — | Upgrade gdk-pixbuf2-develUpgrade gdk-pixbuf2-testsUpgrade gdk-pixbuf2-debuginfoUpgrade gdk-pixbuf2 | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade gdk-pixbuf2-testsUpgrade gdk-pixbuf2-tests-debuginfoUpgrade gdk-pixbuf2Upgrade gdk-pixbuf2-develUpgrade gdk-pixbuf2-debugsourceUpgrade gdk-pixbuf2-modulesUpgrade gdk-pixbuf2-devel-debuginfoUpgrade gdk-pixbuf2-debuginfoUpgrade gdk-pixbuf2-modules-debuginfo | Aug 5, 2025 | Jan 26, 2024 |
| Debian | — | Upgrade gdk-pixbuf | Jul 30, 2024 | Jan 26, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade gdk-pixbuf2Upgrade gdk-pixbuf2-helpUpgrade gdk-pixbuf2-devel | Nov 11, 2024 | Jan 26, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade gdk-pixbuf2-helpUpgrade gdk-pixbuf2Upgrade gdk-pixbuf2-modulesUpgrade gdk-pixbuf2-devel | Nov 26, 2024 | Jan 26, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade gdk-pixbuf2-develUpgrade gdk-pixbuf2-helpUpgrade gdk-pixbuf2 | Nov 11, 2024 | Jan 26, 2024 |
| Oracle_linux | — | Upgrade gdk-pixbuf2Upgrade gdk-pixbuf2-xlib-develUpgrade gdk-pixbuf2-develUpgrade gdk-pixbuf2-xlibUpgrade gdk-pixbuf2-modules | May 30, 2024 | Jan 26, 2024 |
| Redhat_linux | — | Upgrade gdk-pixbuf2-tests-debuginfoNo solution existsUpgrade gdk-pixbuf2-debuginfoUpgrade gdk-pixbuf2-modulesUpgrade gdk-pixbuf2-debugsourceUpgrade gdk-pixbuf2-develUpgrade gdk-pixbuf2-xlibUpgrade gdk-pixbuf2-devel-debuginfoUpgrade gdk-pixbuf2-xlib-debuginfoUpgrade gdk-pixbuf2-xlib-develUpgrade gdk-pixbuf2-modules-debuginfoUpgrade gdk-pixbuf2 | May 24, 2024 | Jan 26, 2024 |
| Rocky_linux | — | Upgrade gdk-pixbuf2-debuginfoUpgrade gdk-pixbuf2-modules-debuginfoUpgrade gdk-pixbuf2-xlibUpgrade gdk-pixbuf2-modulesUpgrade gdk-pixbuf2-develUpgrade gdk-pixbuf2Upgrade gdk-pixbuf2-xlib-debuginfoUpgrade gdk-pixbuf2-devel-debuginfoUpgrade gdk-pixbuf2-debugsourceUpgrade gdk-pixbuf2-xlib-devel | Jun 17, 2024 | Jan 26, 2024 |
| Suse | — | Upgrade typelib-1_0-GdkPixbuf-2_0Upgrade gdk-pixbuf-thumbnailerUpgrade gdk-pixbuf-develUpgrade libgdk_pixbuf-2_0-0Upgrade gdk-pixbuf-query-loaders-32bitUpgrade gdk-pixbuf-langUpgrade gdk-pixbuf-query-loadersUpgrade gdk-pixbuf-devel-32bitUpgrade typelib-1_0-GdkPixdata-2_0Upgrade libgdk_pixbuf-2_0-0-32bit | Aug 9, 2024 | Jan 26, 2024 |
| Ubuntu | — | Upgrade libgdk-pixbuf2.0-0 (Ubuntu Pro)Upgrade libgdk-pixbuf-2.0-0Upgrade libgdk-pixbuf2.0-0 | Jun 7, 2024 | Jan 26, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub