Vulnerability Spotlight: Multiple Gdk-Pixbuf Vulnerabilities
Summary: Cisco Talos disclosed two remote code execution vulnerabilities in the Gdk-Pixbuf Toolkit, used in Chromium, Firefox, GNOME thumbnailer, VLC and other desktop applications, where a crafted TIFF or JPEG image executes attacker code with the local user's privileges. The TIFF flaw is an integer overflow in tiff_image_parse that occurs only when the library is compiled with the -O3 optimization flag, because the compiler removes the overflow checks as undefined behavior, while the JPEG flaw is a heap overflow from an incorrect output buffer size calculation in gdk_pixbuf__jpeg_image_load_increment.
What's compelling: The TIFF bug only appears under -O3 compilation, so whether a given build is exposed depends on how it was compiled, and the exploit path is simply a user opening an image in applications including Chromium, Firefox and VLC.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026