Description
Multiple integer overflows in the read_bitmap_file_data function in io-xbm.c in gdk-pixbuf before 2.26.1 allow remote attackers to cause a denial of service (application crash) via a negative (1) height or (2) width in an XBM file, which triggers a heap-based buffer overflow.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | gdk-pixbuf | 2.26.1-1 | — |
| Debian 13 | gdk-pixbuf | 2.26.1-1 | — |
| Debian 12 | gdk-pixbuf | 2.26.1-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | gtk2 +1 | 2.10.4-29.el5 | RHSA-2013:0135 |
Advisories 1
- RHSA-2013:0135 Red Hat Security Advisory: gtk2 security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- GLSA-201206-20 vendor-advisory
- RHSA-2013:0135 vendor-advisory
- http://git.gnome.org/browse/gdk-pixbuf/commit/?id=b1bb3053856aede37d473c92f0e5a10e29f10516
- https://bugs.launchpad.net/ubuntu/+source/gdk-pixbuf/+bug/681150
- 49125 third-party-advisory
- gdkpixbuf-readbitmapfiledata-bo(75578) vdb-entry
- [oss-security] 20120515 Re: CVE Request: gdk-pixbuf Integer overflow in XBM file loader mailing-list
- http://git.gnome.org/browse/gdk-pixbuf/commit/?id=4f0f465f991cd454d03189497f923eb40c170c22
- 49715 third-party-advisory
- 53548 vdb-entry
- [oss-security] 20120515 CVE Request: gdk-pixbuf Integer overflow in XBM file loader mailing-list
- http://git.gnome.org/browse/gdk-pixbuf/