Bug 2544420 (CVE-2026-103641)

Summary: CVE-2026-103641 gegl: gegl04: gegl: out-of-bounds read in the Radiance HDR uncompressed scanline decoder
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in GEGL. The Radiance HDR loader reads past the end of a memory-mapped image when an uncompressed scanline is shorter than the width declared in the file header. Opening a crafted HDR file crashes the application that uses the loader.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2544422    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-01 03:27:45 UTC 
A flaw was found in GEGL's Radiance HDR (RGBE) image loader. rgbe_read_uncompressed() reads x_axis.size times 4 bytes from the memory-mapped file for every scanline and does not compare that length with the bytes remaining in the file. rgbe_rgbe_to_float() then loads those bytes. A crafted .hdr file whose declared image is larger than its scanline data can make the application that opens it crash. The pixel buffer is sized for the declared image, so this path is a read past the file mapping. It is distinct from the RLE output overflow tracked as CVE-2026-2050 and from the allocation overflow tracked as CVE-2026-18300: a height below the 32768-pixel cap still reaches the unbounded read.