{ "affected": [ { "ranges": [ { "database_specific": { "extracted_events": [ { "cpe": "cpe:2.3:a:gnome:gdk-pixbuf:*:*:*:*:*:*:*:*", "range": [ { "introduced": "0" }, { "fixed": "2.44.6" } ], "source": "CPE_RANGE" } ] }, "events": [ { "introduced": "0" }, { "fixed": "cbbcb7f1b6334b5ca6c644aca2f0a8a0067aec58" } ], "repo": "https://github.com/gnome/gdk-pixbuf", "type": "GIT" } ] }, { "ranges": [ { "database_specific": { "extracted_events": [ { "cpe": "cpe:2.3:a:gnome:gdk-pixbuf:*:*:*:*:*:*:*:*", "range": [ { "introduced": "0" }, { "fixed": "2.44.6" } ], "source": "CPE_RANGE" } ] }, "events": [ { "introduced": "0" }, { "fixed": "cbbcb7f1b6334b5ca6c644aca2f0a8a0067aec58" } ], "repo": "https://gitlab.gnome.org/gnome/gdk-pixbuf", "type": "GIT" } ] } ], "database_specific": { "cna_assigner": "redhat", "cwe_ids": [ "CWE-122" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5201.json", "unresolved_ranges": [ { "extracted_events": [ { "range": [ { "fixed": "0:2.42.12-4.el10_1.5" }, { "fixed": "0:2.42.12-4.el10_2.5" }, { "fixed": "0:2.42.12-4.el10_0.4" }, { "fixed": "0:2.36.12-5.el7_9" }, { "fixed": "0:2.36.12-8.el8_10" }, { "fixed": "0:2.36.12-8.el8_10" }, { "fixed": "0:2.36.12-7.el8_2" }, { "fixed": "0:2.36.12-7.el8_4" }, { "fixed": "0:2.36.12-7.el8_4" }, { "fixed": "0:2.36.12-7.el8_6" }, { "fixed": "0:2.36.12-7.el8_6" }, { "fixed": "0:2.36.12-7.el8_6" }, { "fixed": "0:2.36.12-7.el8_8" }, { "fixed": "0:2.36.12-7.el8_8" }, { "fixed": "0:2.42.6-6.el9_7.1" }, { "fixed": "0:2.42.6-6.el9_8.1" }, { "fixed": "0:2.42.6-3.el9_0.1" }, { "fixed": "0:2.42.6-4.el9_2.1" }, { "fixed": "0:2.42.6-5.el9_4.1" }, { "fixed": "0:2.42.6-6.el9_6.1" }, { "fixed": "1779223654" }, { "fixed": "1779223651" }, { "fixed": "1780681984" }, { "fixed": "1778244559" }, { "fixed": "1778244531" }, { "fixed": "1778274666" }, { "fixed": "1778244546" } ], "source": "AFFECTED_FIELD", "strategy": "InverseAffectedRanges" } ] } ] }, "details": "A flaw was found in the gdk-pixbuf library. This heap-based buffer overflow vulnerability occurs in the JPEG image loader due to improper validation of color component counts when processing a specially crafted JPEG image. A remote attacker can exploit this flaw without user interaction, for example, via thumbnail generation. Successful exploitation leads to application crashes and denial of service (DoS) conditions.", "id": "CVE-2026-5201", "modified": "2026-11-05T21:15:31.939631867Z", "published": "2026-03-31T08:32:58.344Z", "references": [ { "type": "WEB", "url": "https://access.redhat.com/downloads/content/package-browser/" }, { "type": "WEB", "url": "https://catalog.redhat.com/software/containers/" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2026/04/msg00010.html" }, { "type": "WEB", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5201.json" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:10707" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:10708" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:10741" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:11325" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:11326" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:11327" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:11328" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:11806" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:12060" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:12061" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:12062" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:12114" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:12115" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:16008" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:16009" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:16030" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:16174" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:19127" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:19210" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:19724" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:19725" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:25096" }, { "type": "ADVISORY", "url": "https://access.redhat.com/security/cve/CVE-2026-5201" }, { "type": "ADVISORY", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5201.json" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5201" }, { "type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453291" }, { "type": "REPORT", "url": "https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/304" } ], "schema_version": "1.9.2", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "type": "CVSS_V3" } ], "summary": "Gdk-pixbuf: gdk-pixbuf: denial of service via heap-based buffer overflow when processing a specially crafted jpeg image" }