CVE-2022-48622: Out-of-bounds Write

January 26, 2024 (updated February 2, 2024)

In GNOME GdkPixbuf (aka gdk-pixbuf) through 2.42.10, the ANI (Windows animated cursor) decoder encounters heap memory corruption (in ani_load_chunk in io-ani.c) when parsing chunks in a crafted .ani file. A crafted file could allow an attacker to overwrite heap metadata, leading to a denial of service or code execution attack. This occurs in gdk_pixbuf_set_option() in gdk-pixbuf.c.

References

gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/202
nvd.nist.gov/vuln/detail/CVE-2022-48622

Code Behaviors & Features

Detect and mitigate CVE-2022-48622 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →