Critical Buffer Overflow Vulnerability in gdk-pixbuf2 Package
Summary
RLSA-2026:19127: Important: gdk-pixbuf2 security update. Affects gdk-pixbuf2 versions < 0:2.42.12-4.el10_1.5. Fixed in 0:2.42.12-4.el10_1.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The gdk-pixbuf2 package is an essential image loading library utilized by various graphical toolkits, including GTK+ and Clutter. It supports the extension of image formats through loadable modules, making it versatile for developers. However, its functionality also exposes it to security vulnerabilities, particularly when processing untrusted image files.
Vulnerability Detail
The vulnerability identified as CVE-2026-5201 is a denial of service issue caused by a heap-based buffer overflow when gdk-pixbuf2 processes a specially crafted JPEG image. This flaw can lead to application crashes, potentially allowing an attacker to disrupt service or exploit the system further. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
0:2.42.12-4.el10_1.5
This is the first release that contains the fix.
sudo dnf update gdk-pixbuf2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to avoid processing untrusted JPEG images until the package is updated. This can help mitigate the risk of exploitation until a patch is applied.
Conclusion
The gdk-pixbuf2 package has a critical vulnerability (CVE-2026-5201) that can lead to denial of service through a buffer overflow when handling certain JPEG images. It is crucial for users to update to the patched version to ensure the security of their applications.
See every vulnerability recorded for gdk-pixbuf2 →
FAQ
CVE-2026-5201 is a vulnerability in the gdk-pixbuf2 package that allows for a denial of service due to a heap-based buffer overflow when processing specially crafted JPEG images.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The primary impact is a denial of service, which can lead to application crashes and potential disruption of services.
Yes, a patched version of gdk-pixbuf2 is available. Users should update to version 0:2.42.12-4.el10_1.5 to mitigate the vulnerability.
If an immediate update is not possible, avoid processing untrusted JPEG images to reduce the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for gdk-pixbuf2.
