Gnome
236 CVEs across 112 Gnome products. Browse Gnome vulnerabilities, severities, and proof-of-concept exploits.
Gnome products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-18487 | Medium | 5.4 | 2026-08-06 | A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to fake the domain name shown in the address bar. If a user clic… |
CVE-2026-18358 | High | 7.5 | 2026-07-31 | A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon is running in system mode with RDP enabled, the incoming conne… |
CVE-2026-66759 | High | 7.1 | 2026-07-27 | A flaw was found in the file-icns plugin in GIMP. When applying a decompressed mask during ICNS image processing, the plugin reads from the mask data buffer wi… |
CVE-2026-66758 | High | 7.8 | 2026-07-27 | A flaw was found in the file-fits plugin in GIMP. When processing a FITS image file, the plugin calculates memory allocation sizes using signed 32-bit integers… |
CVE-2026-66757 | Medium | 5.5 | 2026-07-27 | A flaw was found in the file-sgi plugin in GIMP. When processing an RLE-compressed SGI image, the plugin allocates memory for a row table. The image header dim… |
CVE-2026-16768 | Medium | 5.3 | 2026-07-23 | A flaw was found in gdk-pixbuf. When parsing a specially crafted ICO file with pixel values that exceed the defined palette range, an out-of-bounds read can oc… |
CVE-2026-16615 | Medium | 6.8 | 2026-07-22 | A flaw was found in librest. The PKCE implementation for OAuth authorization uses the GRand function from the GLib API, a cryptographically insecure pseudo-ran… |
CVE-2026-58016 | High | 7.5 | 2026-06-30 | A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when processing malformed D-Bus… |
CVE-2026-58015 | Medium | 5.9 | 2026-06-30 | A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context param… |
CVE-2026-58014 | High | 7.3 | 2026-06-30 | A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key file with a… |
CVE-2026-58013 | Medium | 6.5 | 2026-06-30 | A flaw was found in GLib. A buffer over-read can occur in g_io_channel_read_line_backend() in the giochannel.c file when a custom line terminator with a length… |
CVE-2026-58012 | Medium | 6.5 | 2026-06-30 | A flaw was found in GLib. A buffer over-read can occur in the g_regex_replace function when used with the `G_REGEX_RAW` compile flag and case-change replacemen… |
CVE-2026-58011 | Medium | 6.5 | 2026-06-30 | A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the g_date_time_get_ymd function in the glib/gdatetime.c file when an invalid GDat… |
CVE-2026-58010 | Medium | 6.5 | 2026-06-30 | A flaw was found in GLib. An off-by-one error can occur in the gvs_tuple_is_normal function in the glib/gvariant-serialiser.c file when doing an alignment padd… |
CVE-2026-13601 | High | 7.1 | 2026-06-29 | A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl. A malicious Flatpak application can ope… |
CVE-2026-12549 | Medium | 4.8 | 2026-06-22 | The fix for CVE-2026-2443 was regressed by a subsequent rework commit that replaced specific overflow checks with a general signed comparison. When a client se… |
CVE-2026-6653 | Critical | 9.8 | 2026-06-22 | Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via malici… |
CVE-2026-2604 | Medium | 5.6 | 2026-06-17 | A flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpak application with D-Bus access to craf… |
CVE-2026-1767 | Medium | 5.6 | 2026-06-16 | A flaw was found in the GNOME localsearch (previously known as tracker-miners) MP3 Extractor `tracker-extract-mp3` component. A remote attacker could exploit t… |
CVE-2026-1766 | Medium | 5.6 | 2026-06-16 | A flaw was found in GNOME localsearch (previously known as tracker-miners) MP3 Extractor, specifically within the tracker-extract-mp3 component. This heap buff… |
CVE-2026-1764 | Medium | 5.6 | 2026-06-16 | A flaw was found in GNOME localsearch (previously known as tracker-miners) MP3 Extractor. When processing specially crafted MP3 files containing ID3v2.4 tags… |
CVE-2026-44931 | | 2026-05-13 | The newly introduced RecordUsage D-Bus method https://gitlab.freedesktop.org/pwithnall/malcontent/-/blob/0.14.0/libmalcontent-timer/child-timer-service.c in … | |
CVE-2026-2708 | Low | 3.7 | 2026-04-23 | A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-he… |
CVE-2026-5201 | High | 7.5 | 2026-03-31 | A flaw was found in the gdk-pixbuf library. This heap-based buffer overflow vulnerability occurs in the JPEG image loader due to improper validation of color c… |
CVE-2026-5119 | Medium | 5.9 | 2026-03-30 | A flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in cleartext within the… |
CVE-2026-2436 | Medium | 6.5 | 2026-03-26 | A flaw was found in libsoup's SoupServer. A remote attacker could exploit a use-after-free vulnerability where the `soup_server_disconnect()` function frees co… |
CVE-2026-2369 | Medium | 6.5 | 2026-03-19 | A flaw was found in libsoup. An integer underflow vulnerability occurs when processing content with a zero-length resource, leading to a buffer overread. This… |
CVE-2026-4271 | Medium | 5.3 | 2026-03-17 | A flaw was found in libsoup, a library for handling HTTP requests. This vulnerability, known as a Use-After-Free, occurs in the HTTP/2 server implementation. A… |
CVE-2026-3634 | Low | 3.9 | 2026-03-17 | A flaw was found in libsoup. An attacker controlling the value used to set the Content-Type header can inject a Carriage Return Line Feed (CRLF) sequence due t… |
CVE-2026-3633 | Low | 3.9 | 2026-03-17 | A flaw was found in libsoup. A remote attacker, by controlling the method parameter of the `soup_message_new()` function, could inject arbitrary headers and ad… |
CVE-2026-3632 | Low | 3.9 | 2026-03-17 | A flaw was found in libsoup, a library used by applications to send network requests. This vulnerability occurs because libsoup does not properly validate host… |
CVE-2026-3099 | Medium | 5.8 | 2026-03-12 | A flaw was found in Libsoup. The server-side digest authentication implementation in the SoupAuthDomainDigest class does not properly track issued nonces or en… |
CVE-2026-2443 | Medium | 5.3 | 2026-02-13 | A flaw was identified in libsoup, a widely used HTTP library in GNOME-based systems. When processing specially crafted HTTP Range headers, the library may impr… |
CVE-2026-1801 | Medium | 5.3 | 2026-02-03 | A flaw was found in libsoup, an HTTP client/server library. This HTTP Request Smuggling vulnerability arises from non-RFC-compliant parsing in the soup_filter_… |
CVE-2020-37011 | High | 7.5 | 2026-01-29 | Gnome Fonts Viewer 3.34.0 contains a heap corruption vulnerability that allows attackers to trigger an out-of-bounds write by crafting a malicious TTF font fil… |
CVE-2026-1539 | Medium | 5.8 | 2026-01-28 | A flaw was found in the libsoup HTTP library that can cause proxy authentication credentials to be sent to unintended destinations. When handling HTTP redirect… |
CVE-2026-1536 | Medium | 5.8 | 2026-01-28 | A flaw was found in libsoup. An attacker who can control the input for the Content-Disposition header can inject CRLF (Carriage Return Line Feed) sequences int… |
CVE-2026-1467 | Medium | 5.8 | 2026-01-27 | A flaw was found in libsoup, an HTTP client library. This vulnerability, known as CRLF (Carriage Return Line Feed) Injection, occurs when an HTTP proxy is conf… |
CVE-2025-14512 | Medium | 6.5 | 2025-12-11 | A flaw was found in glib. This vulnerability allows a heap buffer overflow and denial-of-service (DoS) via an integer overflow in GLib's GIO (GLib Input/Output… |
CVE-2025-14087 | Medium | 5.6 | 2025-12-10 | A flaw was found in GLib (Gnome Lib). This vulnerability allows a remote attacker to cause heap corruption, leading to a denial of service or potential code ex… |
CVE-2025-13601 | High | 7.7 | 2025-11-26 | A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to… |
CVE-2025-12105 | High | 7.5 | 2025-10-23 | A flaw was found in the asynchronous message queue handling of the libsoup library, widely used by GNOME and WebKit-based applications to manage HTTP/2 communi… |
CVE-2025-4056 | High | 7.5 | 2025-07-28 | A flaw was found in GLib. A denial of service on Windows platforms may occur if an application attempts to spawn a program using long command lines. |
CVE-2025-7425 | High | 7.8 | 2025-07-10 | A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as… |
CVE-2025-7424 | High | 7.5 | 2025-07-10 | A flaw was found in the libxslt library. The same memory field, psvi, is used for both stylesheet and input data, which can lead to type confusion during XML t… |
CVE-2025-6199 | Low | 3.3 | 2025-06-17 | A flaw was found in the GIF parser of GdkPixbuf’s LZW decoder. When an invalid symbol is encountered during decompression, the decoder sets the reported output… |
CVE-2025-6196 | Medium | 5.5 | 2025-06-17 | A flaw was found in libgepub, a library used to read EPUB files. The software mishandles file size calculations when opening specially crafted EPUB files, lead… |
CVE-2025-49795 | High | 7.5 | 2025-06-16 | A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This flaw allows an attacker to craft a malicious XML inpu… |
CVE-2025-6052 | Low | 3.7 | 2025-06-13 | A flaw was found in how GLib’s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a… |
CVE-2023-5616 | Medium | 4.9 | 2025-04-15 | In Ubuntu, gnome-control-center did not properly reflect SSH remote login status when the system was configured to use systemd socket activation for openssh-se… |
CVE-2025-3155 | High | 7.4 | 2025-04-03 | A flaw was found in Yelp. The Gnome user help application allows the help document to execute arbitrary scripts. This vulnerability allows malicious users to i… |
CVE-2025-2784 | High | 7.0 | 2025-04-03 | A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skip_insight_whitespace() function. Libsoup cli… |
CVE-2022-1736 | Critical | 9.8 | 2025-01-31 | Ubuntu's configuration of gnome-control-center allowed Remote Desktop Sharing to be enabled by default. |
CVE-2023-43091 | Critical | 9.8 | 2024-11-17 | A flaw was found in GNOME Maps, which is vulnerable to a code injection attack via its service.json configuration file. If the configuration file is malicious… |
CVE-2024-52533 | Critical | 9.8 | 2024-11-11 | gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because SOCKS4_CONN_MSG_LEN is not sufficient for a trail… |
CVE-2024-52532 | High | 7.5 | 2024-11-11 | GNOME libsoup before 3.6.1 has an infinite loop, and memory consumption. during the reading of certain patterns of WebSocket data from clients. |
CVE-2024-52531 | Medium | 6.5 | 2024-11-11 | GNOME libsoup before 3.6.1 allows a buffer overflow in applications that perform conversion to UTF-8 in soup_header_parse_param_list_strict. There is a plausib… |
CVE-2024-52530 | High | 7.5 | 2024-11-11 | GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because '\0' characters at the end of header names are ignored, i.e., a "Transf… |
CVE-2024-42415 | High | 8.4 | 2024-10-03 | An integer overflow vulnerability exists in the Compound Document Binary File format parser of v1.14.52 of the GNOME Project G Structured File Library (libgsf)… |
CVE-2024-36474 | High | 8.4 | 2024-10-03 | An integer overflow vulnerability exists in the Compound Document Binary File format parser of the GNOME Project G Structured File Library (libgsf) version v1… |
CVE-2024-34397 | Medium | 5.2 | 2024-05-07 | An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. When a GDBus-based client subscribes to signals from a trusted system… |
CVE-2020-36774 | Medium | 5.5 | 2024-02-19 | plugins/gtk+/glade-gtk-box.c in GNOME Glade before 3.38.1 and 3.39.x before 3.40.0 mishandles widget rebuilding for GladeGtkBox, leading to a denial of service… |
CVE-2022-48622 | High | 7.8 | 2024-01-26 | In GNOME GdkPixbuf (aka gdk-pixbuf) through 2.42.10, the ANI (Windows animated cursor) decoder encounters heap memory corruption (in ani_load_chunk in io-ani.c… |
CVE-2023-5557 | High | 7.5 | 2023-10-13 | A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the tracker-… |
CVE-2023-43090 | Medium | 5.5 | 2023-09-22 | A vulnerability was found in GNOME Shell. GNOME Shell's lock screen allows an unauthenticated local user to view windows of the locked desktop session by using… |
CVE-2023-32665 | Medium | 5.5 | 2023-09-14 | A flaw was found in GLib. GVariant deserialization is vulnerable to an exponential blowup issue where a crafted GVariant can cause excessive processing, leadin… |
CVE-2023-32643 | Medium | 5.3 | 2023-09-14 | A flaw was found in GLib. The GVariant deserialization code is vulnerable to a heap buffer overflow introduced by the fix for CVE-2023-32665. This bug does not… |
CVE-2023-32636 | Medium | 4.7 | 2023-09-14 | A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of service introduced by additional input validation added to resol… |
CVE-2023-32611 | Medium | 5.5 | 2023-09-14 | A flaw was found in GLib. GVariant deserialization is vulnerable to a slowdown issue where a crafted GVariant can cause excessive processing, leading to denial… |
CVE-2023-29499 | Medium | 5.5 | 2023-09-14 | A flaw was found in GLib. GVariant deserialization fails to validate that the input conforms to the expected format, leading to denial of service. |
CVE-2023-36250 | High | 7.8 | 2023-09-14 | CSV Injection vulnerability in GNOME time tracker version 3.0.2, allows local attackers to execute arbitrary code via crafted .tsv file when creating a new rec… |
CVE-2023-38633 | Medium | 5.5 | 2023-07-22 | A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files (on the local filesystem… |
CVE-2023-26081 | High | 7.5 | 2023-02-20 | In Epiphany (aka GNOME Web) through 43.0, untrusted web content can trick users into exfiltrating passwords, because autofill occurs in sandboxed contexts. |
CVE-2019-25085 | Medium | 6.3 | 2022-12-26 | A vulnerability was found in GNOME gvdb. It has been classified as critical. This affects the function gvdb_table_write_contents_async of the file gvdb-builder… |
CVE-2022-37290 | Medium | 5.5 | 2022-11-14 | GNOME Nautilus 42.2 allows a NULL pointer dereference and get_basename application crash via a pasted ZIP archive. |
CVE-2021-42522 | High | 7.5 | 2022-08-25 | There is a Information Disclosure vulnerability in anjuta/plugins/document-manager/anjuta-bookmarks.c. This issue was caused by the incorrect use of libxml2 AP… |
CVE-2021-3800 | Medium | 5.5 | 2022-08-23 | A flaw was found in glib before version 2.63.6. Due to random charset alias, pkexec can leak content from files owned by privileged users to unprivileged ones… |
CVE-2021-46829 | High | 7.8 | 2022-07-24 | GNOME GdkPixbuf (aka GDK-PixBuf) before 2.42.8 allows a heap-based buffer overflow when compositing or clearing frames in GIF files, as demonstrated by io-gif-… |
CVE-2021-3982 | Medium | 5.5 | 2022-04-29 | Linux distributions using CAP_SYS_NICE for gnome-shell may be exposed to a privilege escalation issue. An attacker, with low privilege permissions, may take ad… |
CVE-2022-29536 | High | 7.5 | 2022-04-20 | In GNOME Epiphany before 41.4 and 42.x before 42.2, an HTML document can trigger a client buffer overflow (in ephy_string_shorten in the UI process) via a long… |
CVE-2021-3567 | High | 7.5 | 2022-03-25 | A flaw was found in Caribou due to a regression of CVE-2020-25712 fix. An attacker could use this flaw to bypass screen-locking applications that leverage Cari… |
CVE-2022-27811 | Critical | 9.8 | 2022-03-24 | GNOME OCRFeeder before 0.8.4 allows OS command injection via shell metacharacters in a PDF or image filename. |
CVE-2021-20315 | Medium | 6.1 | 2022-02-18 | A locking protection bypass flaw was found in some versions of gnome-shell as shipped within CentOS Stream 8, when the "Application menu" or "Window list" GNOM… |
CVE-2021-44648 | High | 8.8 | 2022-01-12 | GNOME gdk-pixbuf 2.42.6 is vulnerable to a heap-buffer overflow vulnerability when decoding the lzw compressed stream of image data in GIF files with lzw minim… |
CVE-2021-45088 | Medium | 6.1 | 2021-12-16 | XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 via an error page. |
CVE-2021-45087 | Medium | 6.1 | 2021-12-16 | XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 when View Source mode or Reader mode is used, as demonstrated by a a page title. |
CVE-2021-45086 | Medium | 6.1 | 2021-12-16 | XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 because a server's suggested_filename is used as the pdf_name value in PDF.js. |
CVE-2021-45085 | Medium | 6.1 | 2021-12-16 | XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 via an about: page, as demonstrated by ephy-about:overview when a user visits an XSS… |
CVE-2021-39365 | Medium | 5.9 | 2021-08-22 | In GNOME grilo though 0.3.13, grl-net-wc.c does not enable TLS certificate verification on the SoupSessionAsync objects it creates, leaving users vulnerable to… |
CVE-2021-39361 | Medium | 5.9 | 2021-08-22 | In GNOME evolution-rss through 0.3.96, network-soup.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vul… |
CVE-2021-39360 | Medium | 5.9 | 2021-08-22 | In GNOME libzapojit through 0.0.3, zpj-skydrive.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnera… |
CVE-2021-39359 | Medium | 5.9 | 2021-08-22 | In GNOME libgda through 6.0.0, gda-web-provider.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnera… |
CVE-2021-39358 | Medium | 5.9 | 2021-08-22 | In GNOME libgfbgraph through 0.2.4, gfbgraph-photo.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vuln… |
CVE-2020-36427 | Medium | 5.5 | 2021-07-19 | GNOME gThumb before 3.10.1 allows an application crash via a malformed JPEG image. |
CVE-2021-20240 | High | 8.8 | 2021-05-28 | A flaw was found in gdk-pixbuf in versions before 2.42.0. An integer wraparound leading to an out of bounds write can occur when a crafted GIF image is loaded… |
CVE-2009-3721 | High | 7.8 | 2021-05-26 | Multiple directory traversal and buffer overflow vulnerabilities were discovered in yTNEF, and in Evolution's TNEF parser that is derived from yTNEF. A crafted… |
CVE-2021-20297 | Medium | 5.5 | 2021-05-26 | A flaw was found in NetworkManager in versions before 1.30.0. Setting match.path and activating a profile crashes NetworkManager. The highest threat from this… |
CVE-2016-20011 | High | 7.5 | 2021-05-25 | libgrss through 0.7.0 fails to perform TLS certificate verification when downloading feeds, allowing remote attackers to manipulate the contents of feeds witho… |
CVE-2021-33516 | High | 8.1 | 2021-05-24 | An issue was discovered in GUPnP before 1.0.7 and 1.1.x and 1.2.x before 1.2.5. It allows DNS rebinding. A remote web server can exploit this vulnerability to… |
CVE-2020-36314 | Low | 3.9 | 2021-04-07 | fr-archive-libarchive.c in GNOME file-roller through 3.38.0, as used by GNOME Shell and other software, allows Directory Traversal during extraction because it… |