Bug 2544422

Summary: CVE-2026-103641 gegl04: gegl: out-of-bounds read in the Radiance HDR uncompressed scanline decoder [fedora-all]
Product: [Fedora] Fedora Reporter: Ganesh <gnaik>
Component: gegl04Assignee: Nils Philippsen <nils>
Status: CLOSED RAWHIDE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: medium    
Version: rawhideCC: jridky, nphilipp
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---Flags: fedora-admin-xmlrpc: mirror+
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["92db43e3-08fa-474c-bb62-b90c4539c541"]}
Fixed In Version: gegl04-0.4.72-4.fc46 Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2026-10-15 13:24:16 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2544420    

Description Ganesh 2026-10-01 03:41:56 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A flaw was found in GEGL's Radiance HDR (RGBE) image loader. rgbe_read_uncompressed() reads x_axis.size times 4 bytes from the memory-mapped file for every scanline and does not compare that length with the bytes remaining in the file. rgbe_rgbe_to_float() then loads those bytes. A crafted .hdr file whose declared image is larger than its scanline data can make the application that opens it crash. The pixel buffer is sized for the declared image, so this path is a read past the file mapping. It is distinct from the RLE output overflow tracked as CVE-2026-2050 and from the allocation overflow tracked as CVE-2026-18300: a height below the 32768-pixel cap still reaches the unbounded read.
Comment 1 Fedora Admin user for bugzilla script actions 2026-10-06 01:27:15 UTC 
This package has changed maintainer in Fedora. Reassigning to the new maintainer of this component.