Description
The gdk_pixbuf__gif_image_load function in gdk-pixbuf/io-gif.c in gdk-pixbuf before 2.23.5 does not properly handle certain return values, which allows remote attackers to cause a denial of service (memory consumption) via a crafted GIF image file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | gdk-pixbuf | 2.23.3-3.1 | — |
| Debian 13 | gdk-pixbuf | 2.23.3-3.1 | — |
| Debian 12 | gdk-pixbuf | 2.23.3-3.1 | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | gdk-pixbuf | 2.36.0-1.1 | openSUSE-SU-2024:10453-1 |
Advisories 1
- openSUSE-SU-2024:10453-1 gdk-pixbuf-devel-2.36.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 45656 third-party-advisory
- http://git.gnome.org/browse/gdk-pixbuf/commit/?id=f8569bb13e2aa1584dde61ca545144750f7a7c98
- http://ftp.gnome.org/pub/GNOME/sources/gdk-pixbuf/2.23/gdk-pixbuf-2.23.5.news
- 49715 third-party-advisory
- GLSA-201206-20 vendor-advisory