Description
GNOME GdkPixbuf (aka GDK-PixBuf) before 2.42.8 allows a heap-based buffer overflow when compositing or clearing frames in GIF files, as demonstrated by io-gif-animation.c composite_frame. This overflow is controllable and could be abused for code execution, especially on 32-bit systems.
References (9)
Core 9
Core References
Exploit, Issue Tracking, Third Party Advisory x_refsource_misc
https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/190
Exploit, Third Party Advisory x_refsource_misc
https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/merge_requests/121
Patch, Third Party Advisory x_refsource_misc
https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/commit/bca00032ad68d0b0aa2c1f7558db931e52bd9cd2
Patch, Third Party Advisory x_refsource_misc
https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/commit/5398f04d772f7f8baf5265715696ed88db0f0512
Mailing List, Third Party Advisory x_refsource_misc
https://www.openwall.com/lists/oss-security/2022/07/23/1
Mailing List, Third Party Advisory mailing-list
x_refsource_mlist
http://www.openwall.com/lists/oss-security/2022/07/25/1
Exploit, Third Party Advisory x_refsource_misc
https://github.com/pedrib/PoC/blob/master/fuzzing/CVE-2021-46829/CVE-2021-46829.md
Mailing List, Third Party Advisory vendor-advisory
x_refsource_fedora
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M5IHHEYFD6GDZVALKIPPRD2U4JNZUZWR/
Third Party Advisory vendor-advisory
x_refsource_debian
https://www.debian.org/security/2022/dsa-5228
Scores
CVSS v3
7.8
EPSS
0.0043
EPSS Percentile
62.3%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Details
CWE
CWE-190
Status
published
Products (3)
debian/debian_linux
11.0
fedoraproject/fedora
35
gnome/gdk-pixbuf
< 2.42.8
Published
Jul 24, 2022
Tracked Since
Feb 18, 2026