CVE-2017-2870
HighSummary
An exploitable integer overflow vulnerability exists in the tiff_image_parse functionality of Gdk-Pixbuf 2.36.6 when compiled with Clang. A specially crafted tiff file can cause a heap-overflow resulting in remote code execution.
Risk Assessment
This vulnerability could allow attackers to execute remote code on the victim's system, posing a serious security threat to the organization.
Recommendation
It is recommended to update Gdk-Pixbuf to the latest version to mitigate this vulnerability and to monitor systems for suspicious TIFF files.
Other vulnerabilities in Gdk-Pixbuf 2.36.6
See all- CVE-2017-2862High
A heap overflow vulnerability exists in the gdk_pixbuf__jpeg_image_load_increment functionality of Gdk-Pixbuf 2.36.6. A specially crafted jpeg file can cause a heap overflow resulting in remote code execution.
- CVE-2017-6313High
An integer underflow in the load_resources function in io-icns.c in gdk-pixbuf can be exploited by context-dependent attackers to cause a denial of service through a crafted image entry size in an ICO file.
- CVE-2017-6311High
The gdk-pixbuf-thumbnailer.c file in gdk-pixbuf contains a vulnerability that allows context-dependent attackers to cause a denial of service through a NULL pointer dereference, leading to application crashes.
- CVE-2016-6352High
The OneLine32 function in io-ico.c in gdk-pixbuf before version 2.35.3 allows remote attackers to cause a denial of service (out-of-bounds write and crash) via crafted dimensions in an ICO file.
- CVE-2015-8875High
Multiple integer overflows in the pixops_composite_nearest, pixops_composite_color_nearest, and pixops_process functions in gdk-pixbuf before version 2.33.1 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted image.
- CVE-2015-7552High
Heap-based buffer overflow in the gdk_pixbuf_flip function in gdk-pixbuf-scale.c in gdk-pixbuf 2.30.x allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted BMP file.
- CVE-2026-81893Medium
A flaw was found in gdk-pixbuf. When loading a specially crafted JPEG image containing chunked ICC profile markers, an error during ICC profile parsing can leave stale size metadata after the profile buffer is freed. A subsequent allocation in the same decode can cause an out-of-bounds write, potentially crashing the application. To exploit this flaw, an application using gdk-pixbuf must process the malicious JPEG image. Affected version >= 2.26.4.
- CVE-2026-16768Medium
An out-of-bounds read vulnerability was found in the gdk-pixbuf library when parsing a specially crafted ICO file with pixel values exceeding the defined palette range. An attacker can extract heap content via the generated output, such as a thumbnail.
- CVE-2026-5201High
A heap-based buffer overflow vulnerability was found in the gdk-pixbuf library's JPEG image loader due to improper validation of color component counts when processing a specially crafted JPEG image. A remote attacker can exploit this flaw without user interaction, for example, via thumbnail generation, leading to application crashes and denial of service (DoS).
- CVE-2025-7345High
A heap buffer overflow vulnerability has been discovered in the gdk-pixbuf and glib libraries when processing maliciously crafted JPEG images. The flaw resides in the gdk_pixbuf__jpeg_image_load_increment and g_base64_encode_step functions, potentially allowing out-of-bounds reads from heap memory.
Original NVD description (English source)
An exploitable integer overflow vulnerability exists in the tiff_image_parse functionality of Gdk-Pixbuf 2.36.6 when compiled with Clang. A specially crafted tiff file can cause a heap-overflow resulting in remote code execution. An attacker can send a file or a URL to trigger this vulnerability.