Skip to content
Fencer Vulns
high 8.8

CVE-2021-20240 json

A flaw was found in gdk-pixbuf in versions before 2.42.0.

published 2021-05-28 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-7679

cvss
8.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.3%
EPSS 2.3% chance of exploitation in 30 days, percentile 83%
public exploits
0
none known

Summary

A flaw was found in gdk-pixbuf in versions before 2.42.0. An integer wraparound leading to an out of bounds write can occur when a crafted GIF image is loaded. An attacker may cause applications to crash or could potentially execute code on the victim system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Patch / fix

  • gnome gdk-pixbuf 2.39.2
  • gdk-pixbuf Debian 14, Debian 13, Debian 12 2.42.2+dfsg-1

debian advisories DEBIAN-CVE-2021-20240

  • gdk-pixbuf Ubuntu 20.04 LTS 2.40.0+dfsg-3ubuntu0.2

ubuntu advisories UBUNTU-CVE-2021-20240

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • gdk-pixbuf Alpine 3.11 2.40.0-r1
  • gdk-pixbuf Alpine 3.12 2.40.0-r3

alpine advisories ALPINE-CVE-2021-20240

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-20240 updated cvss 8.1

gdk-pixbuf: integer wraparound in the GIF loader of gdk-pixbuf via crafted input leads to segmentation fault

  • Red Hat Enterprise Linux 6 gdk-pixbuf2 Red Hat Enterprise Linux 7 gdk-pixbuf2, gdk-pixbuf2-tests Red Hat Enterprise Linux 8 gdk-pixbuf2, gdk-pixbuf2-xlib, gdk-pixbuf2-modules Red Hat Enterprise Linux 9 gdk-pixbuf2, gdk-pixbuf2-modules
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.35% chance of exploitation in the next 30 days, higher than 83% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD 2.0 8.3 AV:N/AC:M/Au:N/C:P/I:P/A:C

Affected products

  • n/a gdk-pixbuf

Classification

Weakness
  • CWE-191 Integer Underflow (Wrap or Wraparound)

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.