CVE-2022-48622

Name of the Vulnerable Software and Affected Versions GdkPixbuf versions through 2.42.10

Description The issue is related to heap memory corruption in the ANI decoder when parsing chunks in a crafted .ani file. This corruption can occur in the ani load chunk function and may allow an attacker to overwrite heap metadata, potentially leading to a denial of service or code execution attack. The vulnerability is also related to the gdk pixbuf set option function in gdk-pixbuf.c.

Recommendations For versions through 2.42.10, consider disabling the ANI decoder or restricting the use of the ani load chunk function until a patch is available. Additionally, avoid using the gdk pixbuf set option function with crafted .ani files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.