Description
Heap-based buffer overflow in zgv before 5.8 and xzgv before 0.8 might allow user-assisted attackers to execute arbitrary code via a JPEG image with more than 3 output components, such as a CMYK or YCCK color space, which causes less memory to be allocated than required.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 13 | xzgv | 0.8-5.1 | — |
| Debian 12 | xzgv | 0.8-5.1 | — |
| Debian 3.1 | xzgv | 0.8-3sarge1 | DSA-1038-1 |
| Debian 3.1 | zgv | 5.7-1.4 | DSA-1037-1 |
| Debian 3.0 | xzgv | 0.7-6woody3 | DSA-1038-1 |
| Debian 3.0 | zgv | 5.5-3woody3 | DSA-1037-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | xzgv | 0.9.1-27.8 | openSUSE-SU-2024:10151-1 |
Advisories 3
- DSA-1038-1 xzgv - programming error Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1037-1 zgv - programming error Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10151-1 xzgv-0.9.1-27.8 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 17409 vdb-entry
- 19572 third-party-advisory
- 19779 third-party-advisory
- 19790 third-party-advisory
- ADV-2006-1288 vdb-entry
- 19757 third-party-advisory
- SUSE-SR:2006:008 vendor-advisory
- xzgv-jpeg-bo(25718) vdb-entry
- DSA-1037 vendor-advisory
- 19731 third-party-advisory
- 756 third-party-advisory
- 19571 third-party-advisory
- DSA-1038 vendor-advisory