CVE-2026-5201

EUVD-2026-17343
A flaw was found in the gdk-pixbuf library. This heap-based buffer overflow vulnerability occurs in the JPEG image loader due to improper validation of color component counts when processing a specially crafted JPEG image. A remote attacker can exploit this flaw without user interaction, for example, via thumbnail generation. Successful exploitation leads to application crashes and denial of service (DoS) conditions.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 67.22%
Affected Products (NVD)
VendorProductVersion
gnomegdk-pixbuf
𝑥
< 2.44.6
redhatai_inference_server
𝑥
< 3.3.3
redhatenterprise_linux
7.0
redhatenterprise_linux
8.0
redhatenterprise_linux
9.0
redhatenterprise_linux
10.0
redhatenterprise_linux_aus
8.2
redhatenterprise_linux_aus
8.4
redhatenterprise_linux_aus
8.6
redhatenterprise_linux_els
7.0
redhatenterprise_linux_eus
8.4
redhatenterprise_linux_eus
9.4
redhatenterprise_linux_eus
9.6
redhatenterprise_linux_eus
10.0
redhatenterprise_linux_server_aus
8.2
redhatenterprise_linux_server_aus
8.4
redhatenterprise_linux_server_tus
8.8
redhatenterprise_linux_tus
8.6
redhatenterprise_linux_tus
8.8
redhatenterprise_linux_update_services_for_sap_solutions
8.6
redhatenterprise_linux_update_services_for_sap_solutions
8.8
redhatenterprise_linux_update_services_for_sap_solutions
9.0
redhatenterprise_linux_update_services_for_sap_solutions
9.2
redhatenterprise_linux
9.0
redhatenterprise_linux
9.8
redhatenterprise_linux_eus
9.8
redhatenterprise_linux_for_els
9.8
redhatenterprise_linux_for_ibm_z_systems
9.0_s390x
redhatenterprise_linux_for_ibm_z_systems
9.8_s390x
redhatenterprise_linux_for_ibm_z_systems_els
9.8
redhatenterprise_linux_for_ibm_z_systems_eus
9.8
redhatenterprise_linux_for_power_little_endian
9.0
redhatenterprise_linux_for_power_little_endian_els
9.8
redhatenterprise_linux_for_power_little_endian_eus
9.8
redhatenterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions
9.8
redhatenterprise_linux
10.0
redhatenterprise_linux
10.2
redhatenterprise_linux_eus
10.2
redhatenterprise_linux_for_els
10.2
redhatenterprise_linux_for_ibm_z_systems
10.0_s390x
redhatenterprise_linux_for_ibm_z_systems
10.2
redhatenterprise_linux_for_ibm_z_systems_els
10.2
redhatenterprise_linux_for_ibm_z_systems_eus
10.2
redhatenterprise_linux_for_power_little_endian
10.0
redhatenterprise_linux_for_power_little_endian
10.2
redhatenterprise_linux_for_power_little_endian_els
10.2
redhatenterprise_linux_for_power_little_endian_eus
10.2
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
Red HatRed Hat Enterprise Linux 10
0:2.42.12-4.el10_1.5 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 10
0:2.42.12-4.el10_2.5 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support
0:2.42.12-4.el10_0.4 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 7 Extended Lifecycle Support
0:2.36.12-5.el7_9 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8
0:2.36.12-8.el8_10 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.2 Advanced Update Support
0:2.36.12-7.el8_2 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
0:2.36.12-7.el8_4 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
0:2.36.12-7.el8_4 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
0:2.36.12-7.el8_6 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.6 Telecommunications Update Service
0:2.36.12-7.el8_6 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.6 Update Services for SAP Solutions
0:2.36.12-7.el8_6 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Service
0:2.36.12-7.el8_8 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutions
0:2.36.12-7.el8_8 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9
0:2.42.6-6.el9_7.1 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9
0:2.42.6-6.el9_8.1 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9.0 Update Services for SAP Solutions
0:2.42.6-3.el9_0.1 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions
0:2.42.6-4.el9_2.1 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9.4 Extended Update Support
0:2.42.6-5.el9_4.1 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support
0:2.42.6-6.el9_6.1 ≤
𝑥
< *
ADP
Red HatRed Hat AI Inference Server 3.2
1779223654 ≤
𝑥
< *
ADP
Red HatRed Hat AI Inference Server 3.2
1779223651 ≤
𝑥
< *
ADP
Red HatRed Hat AI Inference Server 3.2
1780681984 ≤
𝑥
< *
ADP
Red HatRed Hat AI Inference Server 3.3
1778244559 ≤
𝑥
< *
ADP
Red HatRed Hat AI Inference Server 3.3
1778244531 ≤
𝑥
< *
ADP
Red HatRed Hat AI Inference Server 3.3
1778274666 ≤
𝑥
< *
ADP
Red HatRed Hat AI Inference Server 3.3
1778244546 ≤
𝑥
< *
ADP
Debian logo
Debian Releases
Debian Product
Codename
gdk-pixbuf
bookworm
2.42.10+dfsg-1+deb12u4
fixed
bookworm (security)
2.42.10+dfsg-1+deb12u4
fixed
forky
2.44.8+dfsg-1
fixed
sid
2.44.8+dfsg-1
fixed
trixie
2.42.12+dfsg-4+deb13u1
fixed
trixie (security)
2.42.12+dfsg-4+deb13u1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
gdk-pixbuf
bionic
Fixed in 2.36.11-2ubuntu0.1~esm3
released
focal
Fixed in 2.40.0+dfsg-3ubuntu0.5+esm3
released
jammy
Fixed in 2.42.8+dfsg-1ubuntu0.5
released
noble
Fixed in 2.42.10+dfsg-3ubuntu3.3
released
questing
Fixed in 2.42.12+dfsg-5ubuntu0.1
released
resolute
not-affected
stonking
not-affected
xenial
Fixed in 2.32.2-1ubuntu1.6+esm3
released
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
gdk-pixbuf-devel
suse enterprise desktop 15 SP7
2.42.12-150600.3.11.1
fixed
suse enterprise sap 12 SP5
2.34.0-19.26.1
fixed
suse enterprise sap 15 SP4
2.42.12-150400.5.17.1
fixed
suse enterprise sap 15 SP5
2.42.12-150400.5.17.1
fixed
suse enterprise sap 15 SP6
2.42.12-150600.3.11.1
fixed
suse enterprise sap 15 SP7
2.42.12-150600.3.11.1
fixed
suse enterprise server 12 SP5
2.34.0-19.26.1
fixed
suse enterprise server 15 SP4
2.42.12-150400.5.17.1
fixed
suse enterprise server 15 SP5
2.42.12-150400.5.17.1
fixed
suse enterprise server 15 SP6
2.42.12-150600.3.11.1
fixed
suse enterprise server 15 SP7
2.42.12-150600.3.11.1
fixed
gdk-pixbuf-lang
suse enterprise desktop 15 SP7
2.42.12-150600.3.11.1
fixed
suse enterprise sap 12 SP5
2.34.0-19.26.1
fixed
suse enterprise sap 15 SP4
2.42.12-150400.5.17.1
fixed
suse enterprise sap 15 SP5
2.42.12-150400.5.17.1
fixed
suse enterprise sap 15 SP6
2.42.12-150600.3.11.1
fixed
suse enterprise sap 15 SP7
2.42.12-150600.3.11.1
fixed
suse enterprise server 12 SP3
2.34.0-19.26.1
fixed
suse enterprise server 12 SP5
2.34.0-19.26.1
fixed
suse enterprise server 15 SP4
2.42.12-150400.5.17.1
fixed
suse enterprise server 15 SP5
2.42.12-150400.5.17.1
fixed
suse enterprise server 15 SP6
2.42.12-150600.3.11.1
fixed
suse enterprise server 15 SP7
2.42.12-150600.3.11.1
fixed
gdk-pixbuf-query-loaders
suse enterprise desktop 15 SP7
2.42.12-150600.3.11.1
fixed
suse enterprise sap 12 SP5
2.34.0-19.26.1
fixed
suse enterprise sap 15 SP4
2.42.12-150400.5.17.1
fixed
suse enterprise sap 15 SP5
2.42.12-150400.5.17.1
fixed
suse enterprise sap 15 SP6
2.42.12-150600.3.11.1
fixed
suse enterprise sap 15 SP7
2.42.12-150600.3.11.1
fixed
suse enterprise server 12 SP3
2.34.0-19.26.1
fixed
suse enterprise server 12 SP5
2.34.0-19.26.1
fixed
suse enterprise server 15 SP4
2.42.12-150400.5.17.1
fixed
suse enterprise server 15 SP5
2.42.12-150400.5.17.1
fixed
suse enterprise server 15 SP6
2.42.12-150600.3.11.1
fixed
suse enterprise server 15 SP7
2.42.12-150600.3.11.1
fixed
gdk-pixbuf-query-loaders-32bit
suse enterprise desktop 15 SP7
2.42.12-150600.3.11.1
fixed
suse enterprise sap 12 SP5
2.34.0-19.26.1
fixed
suse enterprise sap 15 SP4
2.42.12-150400.5.17.1
fixed
suse enterprise sap 15 SP5
2.42.12-150400.5.17.1
fixed
suse enterprise sap 15 SP6
2.42.12-150600.3.11.1
fixed
suse enterprise sap 15 SP7
2.42.12-150600.3.11.1
fixed
suse enterprise server 12 SP3
2.34.0-19.26.1
fixed
suse enterprise server 12 SP5
2.34.0-19.26.1
fixed
suse enterprise server 15 SP4
2.42.12-150400.5.17.1
fixed
suse enterprise server 15 SP5
2.42.12-150400.5.17.1
fixed
suse enterprise server 15 SP6
2.42.12-150600.3.11.1
fixed
suse enterprise server 15 SP7
2.42.12-150600.3.11.1
fixed
gdk-pixbuf-thumbnailer
suse enterprise desktop 15 SP7
2.42.12-150600.3.11.1
fixed
suse enterprise sap 15 SP4
2.42.12-150400.5.17.1
fixed
suse enterprise sap 15 SP5
2.42.12-150400.5.17.1
fixed
suse enterprise sap 15 SP6
2.42.12-150600.3.11.1
fixed
suse enterprise sap 15 SP7
2.42.12-150600.3.11.1
fixed
suse enterprise server 15 SP4
2.42.12-150400.5.17.1
fixed
suse enterprise server 15 SP5
2.42.12-150400.5.17.1
fixed
suse enterprise server 15 SP6
2.42.12-150600.3.11.1
fixed
suse enterprise server 15 SP7
2.42.12-150600.3.11.1
fixed
libgdk_pixbuf-2_0-0
suse enterprise desktop 15 SP7
2.42.12-150600.3.11.1
fixed
suse enterprise sap 12 SP5
2.34.0-19.26.1
fixed
suse enterprise sap 15 SP4
2.42.12-150400.5.17.1
fixed
suse enterprise sap 15 SP5
2.42.12-150400.5.17.1
fixed
suse enterprise sap 15 SP6
2.42.12-150600.3.11.1
fixed
suse enterprise sap 15 SP7
2.42.12-150600.3.11.1
fixed
suse enterprise server 12 SP3
2.34.0-19.26.1
fixed
suse enterprise server 12 SP5
2.34.0-19.26.1
fixed
suse enterprise server 15 SP4
2.42.12-150400.5.17.1
fixed
suse enterprise server 15 SP5
2.42.12-150400.5.17.1
fixed
suse enterprise server 15 SP6
2.42.12-150600.3.11.1
fixed
suse enterprise server 15 SP7
2.42.12-150600.3.11.1
fixed
libgdk_pixbuf-2_0-0-32bit
suse enterprise desktop 15 SP7
2.42.12-150600.3.11.1
fixed
suse enterprise sap 12 SP5
2.34.0-19.26.1
fixed
suse enterprise sap 15 SP4
2.42.12-150400.5.17.1
fixed
suse enterprise sap 15 SP5
2.42.12-150400.5.17.1
fixed
suse enterprise sap 15 SP6
2.42.12-150600.3.11.1
fixed
suse enterprise sap 15 SP7
2.42.12-150600.3.11.1
fixed
suse enterprise server 12 SP3
2.34.0-19.26.1
fixed
suse enterprise server 12 SP5
2.34.0-19.26.1
fixed
suse enterprise server 15 SP4
2.42.12-150400.5.17.1
fixed
suse enterprise server 15 SP5
2.42.12-150400.5.17.1
fixed
suse enterprise server 15 SP6
2.42.12-150600.3.11.1
fixed
suse enterprise server 15 SP7
2.42.12-150600.3.11.1
fixed
typelib-1_0-GdkPixbuf-2_0
suse enterprise desktop 15 SP7
2.42.12-150600.3.11.1
fixed
suse enterprise sap 12 SP5
2.34.0-19.26.1
fixed
suse enterprise sap 15 SP4
2.42.12-150400.5.17.1
fixed
suse enterprise sap 15 SP5
2.42.12-150400.5.17.1
fixed
suse enterprise sap 15 SP6
2.42.12-150600.3.11.1
fixed
suse enterprise sap 15 SP7
2.42.12-150600.3.11.1
fixed
suse enterprise server 12 SP3
2.34.0-19.26.1
fixed
suse enterprise server 12 SP5
2.34.0-19.26.1
fixed
suse enterprise server 15 SP4
2.42.12-150400.5.17.1
fixed
suse enterprise server 15 SP5
2.42.12-150400.5.17.1
fixed
suse enterprise server 15 SP6
2.42.12-150600.3.11.1
fixed
suse enterprise server 15 SP7
2.42.12-150600.3.11.1
fixed
typelib-1_0-GdkPixdata-2_0
suse enterprise desktop 15 SP7
2.42.12-150600.3.11.1
fixed
suse enterprise sap 15 SP4
2.42.12-150400.5.17.1
fixed
suse enterprise sap 15 SP5
2.42.12-150400.5.17.1
fixed
suse enterprise sap 15 SP6
2.42.12-150600.3.11.1
fixed
suse enterprise sap 15 SP7
2.42.12-150600.3.11.1
fixed
suse enterprise server 15 SP4
2.42.12-150400.5.17.1
fixed
suse enterprise server 15 SP5
2.42.12-150400.5.17.1
fixed
suse enterprise server 15 SP6
2.42.12-150600.3.11.1
fixed
suse enterprise server 15 SP7
2.42.12-150600.3.11.1
fixed
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
gdk-pixbuf2
RHEL 8
0:2.36.12-8.el8_10
fixed
RHEL 8.2 AUS
0:2.36.12-7.el8_2
fixed
RHEL 8.4 AUS
0:2.36.12-7.el8_4
fixed
RHEL 8.6 AUS
0:2.36.12-7.el8_6
fixed
RHEL 8.6 E4S
0:2.36.12-7.el8_6
fixed
RHEL 8.6 TUS
0:2.36.12-7.el8_6
fixed
RHEL 8.8 E4S
0:2.36.12-7.el8_8
fixed
RHEL 8.8 TUS
0:2.36.12-7.el8_8
fixed
RHEL 9
0:2.42.6-6.el9_8.1
fixed
gdk-pixbuf2-devel
RHEL 8
0:2.36.12-8.el8_10
fixed
RHEL 8.2 AUS
0:2.36.12-7.el8_2
fixed
RHEL 8.4 AUS
0:2.36.12-7.el8_4
fixed
RHEL 8.6 AUS
0:2.36.12-7.el8_6
fixed
RHEL 8.6 E4S
0:2.36.12-7.el8_6
fixed
RHEL 8.6 TUS
0:2.36.12-7.el8_6
fixed
RHEL 8.8 E4S
0:2.36.12-7.el8_8
fixed
RHEL 8.8 TUS
0:2.36.12-7.el8_8
fixed
RHEL 9
0:2.42.6-6.el9_8.1
fixed
gdk-pixbuf2-modules
RHEL 8
0:2.36.12-8.el8_10
fixed
RHEL 8.2 AUS
0:2.36.12-7.el8_2
fixed
RHEL 8.4 AUS
0:2.36.12-7.el8_4
fixed
RHEL 8.6 AUS
0:2.36.12-7.el8_6
fixed
RHEL 8.6 E4S
0:2.36.12-7.el8_6
fixed
RHEL 8.6 TUS
0:2.36.12-7.el8_6
fixed
RHEL 8.8 E4S
0:2.36.12-7.el8_8
fixed
RHEL 8.8 TUS
0:2.36.12-7.el8_8
fixed
RHEL 9
0:2.42.6-6.el9_8.1
fixed
gdk-pixbuf2-xlib
RHEL 8
0:2.36.12-8.el8_10
fixed
gdk-pixbuf2-xlib-devel
RHEL 8
0:2.36.12-8.el8_10
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
gdk-pixbuf2
Amazon Linux 2
0:2.36.12-3.amzn2.0.3
fixed
Amazon Linux 2023
0:2.42.12-185.amzn2023
fixed
gdk-pixbuf2-debuginfo
Amazon Linux 2
0:2.36.12-3.amzn2.0.3
fixed
Amazon Linux 2023
0:2.42.12-185.amzn2023
fixed
gdk-pixbuf2-debugsource
Amazon Linux 2023
0:2.42.12-185.amzn2023
fixed
gdk-pixbuf2-devel
Amazon Linux 2
0:2.36.12-3.amzn2.0.3
fixed
Amazon Linux 2023
0:2.42.12-185.amzn2023
fixed
gdk-pixbuf2-devel-debuginfo
Amazon Linux 2023
0:2.42.12-185.amzn2023
fixed
gdk-pixbuf2-modules
Amazon Linux 2023
0:2.42.12-185.amzn2023
fixed
gdk-pixbuf2-modules-debuginfo
Amazon Linux 2023
0:2.42.12-185.amzn2023
fixed
gdk-pixbuf2-tests
Amazon Linux 2
0:2.36.12-3.amzn2.0.3
fixed
Amazon Linux 2023
0:2.42.12-185.amzn2023
fixed
gdk-pixbuf2-tests-debuginfo
Amazon Linux 2023
0:2.42.12-185.amzn2023
fixed
Azure Linux logo
Azure Linux Releases
Azure Package
Release
gdk-pixbuf2
Azure Linux 3.0
0:2.42.10-5.azl3
fixed
Common Weakness Enumeration
References
https://access.redhat.com/errata/RHSA-2026:10707
https://access.redhat.com/errata/RHSA-2026:10708
https://access.redhat.com/errata/RHSA-2026:10741
https://access.redhat.com/errata/RHSA-2026:11325
https://access.redhat.com/errata/RHSA-2026:11326
https://access.redhat.com/errata/RHSA-2026:11327
https://access.redhat.com/errata/RHSA-2026:11328
https://access.redhat.com/errata/RHSA-2026:11806
https://access.redhat.com/errata/RHSA-2026:12060
https://access.redhat.com/errata/RHSA-2026:12061
https://access.redhat.com/errata/RHSA-2026:12062
https://access.redhat.com/errata/RHSA-2026:12114
https://access.redhat.com/errata/RHSA-2026:12115
https://access.redhat.com/errata/RHSA-2026:16008
https://access.redhat.com/errata/RHSA-2026:16009
https://access.redhat.com/errata/RHSA-2026:16030
https://access.redhat.com/errata/RHSA-2026:16174
https://access.redhat.com/errata/RHSA-2026:19127
https://access.redhat.com/errata/RHSA-2026:19210
https://access.redhat.com/errata/RHSA-2026:19724
https://access.redhat.com/errata/RHSA-2026:19725
https://access.redhat.com/errata/RHSA-2026:25096
https://access.redhat.com/security/cve/CVE-2026-5201
https://bugzilla.redhat.com/show_bug.cgi?id=2453291
https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/304
https://lists.debian.org/debian-lts-announce/2026/04/msg00010.html
https://access.redhat.com/errata/RHSA-2026:10707
https://access.redhat.com/errata/RHSA-2026:10708
https://access.redhat.com/errata/RHSA-2026:10741
https://access.redhat.com/errata/RHSA-2026:11325
https://access.redhat.com/errata/RHSA-2026:11326
https://access.redhat.com/errata/RHSA-2026:11327
https://access.redhat.com/errata/RHSA-2026:11328
https://access.redhat.com/errata/RHSA-2026:11806
https://access.redhat.com/errata/RHSA-2026:12060
https://access.redhat.com/errata/RHSA-2026:12061
https://access.redhat.com/errata/RHSA-2026:12062
https://access.redhat.com/errata/RHSA-2026:12114
https://access.redhat.com/errata/RHSA-2026:12115
https://access.redhat.com/errata/RHSA-2026:16008
https://access.redhat.com/errata/RHSA-2026:16009
https://access.redhat.com/errata/RHSA-2026:16030
https://access.redhat.com/errata/RHSA-2026:16174
https://access.redhat.com/errata/RHSA-2026:19127
https://access.redhat.com/errata/RHSA-2026:19210
https://access.redhat.com/errata/RHSA-2026:19724
https://access.redhat.com/errata/RHSA-2026:19725
https://access.redhat.com/errata/RHSA-2026:25096
https://access.redhat.com/security/cve/CVE-2026-5201
https://bugzilla.redhat.com/show_bug.cgi?id=2453291
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5201.json