CVE-2026-5201: Gdk-pixbuf: gdk-pixbuf: denial of service via heap-based buffer overflow when processing a specially crafted jpeg image

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-31 · updated 2026-10-29
Weakness: CWE-122

Description

A flaw was found in the gdk-pixbuf library. This heap-based buffer overflow vulnerability occurs in the JPEG image loader due to improper validation of color component counts when processing a specially crafted JPEG image. A remote attacker can exploit this flaw without user interaction, for example, via thumbnail generation. Successful exploitation leads to application crashes and denial of service (DoS) conditions.

Affected products

GNOME Gdk-Pixbuf: before 2.44.6 — fixed in 2.44.6
Red Hat AI Inference Server: before 3.3.3 — fixed in 3.3.3
Red Hat Enterprise Linux: 7.0, 8.0, 9.0, 10.0, 9.8, 10.2 (and their updates)
RedHat Enterprise Linux Aus: 8.2, 8.4, 8.6 (and their updates)
RedHat Enterprise Linux Els: 7.0 (and their updates)
RedHat Enterprise Linux Eus: 8.4, 9.4, 9.6, 10.0, 9.8, 10.2 (and their updates)
RedHat Enterprise Linux For Els: 9.8, 10.2 (and their updates)
RedHat Enterprise Linux For Ibm Z Systems: 9.0_s390x, 9.8_s390x, 10.0_s390x, 10.2 (and their updates)
RedHat Enterprise Linux For Ibm Z Systems Els: 9.8, 10.2 (and their updates)
RedHat Enterprise Linux For Ibm Z Systems Eus: 9.8, 10.2 (and their updates)
RedHat Enterprise Linux For Power Little Endian: 9.0, 10.0, 10.2 (and their updates)
RedHat Enterprise Linux For Power Little Endian Els: 9.8, 10.2 (and their updates)
RedHat Enterprise Linux For Power Little Endian Eus: 9.8, 10.2 (and their updates)
RedHat Enterprise Linux Server Aus: 8.2, 8.4 (and their updates)
RedHat Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions: 9.8 (and their updates)
RedHat Enterprise Linux Server Tus: 8.8 (and their updates)
RedHat Enterprise Linux Tus: 8.6, 8.8 (and their updates)
RedHat Enterprise Linux Update Services For Sap Solutions: 8.6, 8.8, 9.0, 9.2 (and their updates)

How to fix

Upgrade to a fixed version: GNOME Gdk-Pixbuf 2.44.6; Red Hat AI Inference Server 3.3.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-5201 or the next vulnerability affects your stack