Log in Start free

Vulnerability · Published Oct 1, 2026 · Assigned by redhat

CVE-2026-103641Gegl: gegl04: gegl: out-of-bounds read in the radiance hdr uncompressed scanline decoder

Medium 5.5

In plain English

A medium-severity out-of-bounds read in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.1%top 96.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in GEGL. The Radiance HDR loader reads past the end of a memory-mapped image when an uncompressed scanline is shorter than the width declared in the file header. Opening a crafted HDR file crashes the application that uses the loader.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12geglno fix listedDEBIAN-CVE-2026-103641
Debian:13geglno fix listedDEBIAN-CVE-2026-103641
Debian:14geglno fix listedDEBIAN-CVE-2026-103641
Ubuntu:22.04:LTSgeglno fix listedUBUNTU-CVE-2026-103641
Ubuntu:24.04:LTSgeglno fix listedUBUNTU-CVE-2026-103641
Ubuntu:26.04:LTSgeglno fix listedUBUNTU-CVE-2026-103641
Ubuntu:26.10geglno fix listedUBUNTU-CVE-2026-103641

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 6 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references

Weakness: CWE-125 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References