Description
A flaw was found in gdk-pixbuf in versions before 2.42.0. An integer wraparound leading to an out of bounds write can occur when a crafted GIF image is loaded. An attacker may cause applications to crash or could potentially execute code on the victim system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | gdk-pixbuf | gdk-pixbuf 2.42.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | gdk-pixbuf | 2.42.2+dfsg-1 | — |
| Debian 13 | gdk-pixbuf | 2.42.2+dfsg-1 | — |
| Debian 12 | gdk-pixbuf | 2.42.2+dfsg-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | gdk-pixbuf | 2.40.0+dfsg-3ubuntu0.2 | USN-4743-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.12 | gdk-pixbuf | 2.40.0-r3 | — |
| Alpine v3.11 | gdk-pixbuf | 2.40.0-r1 | — |
Advisories 1
- USN-4743-1 gdk-pixbuf vulnerability Ubuntu Security Notices (USN) · Apr 22, 2026
References
- FEDORA-2021-2e59756cbe vendor-advisory
- FEDORA-2021-755ba8968a vendor-advisory
- FEDORA-2021-c918632e13 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1926787