The vulnerability is a heap‑based buffer overflow in the JPEG loader of the gdk‑pixbuf library. Improper validation of color component counts allows an attacker to craft a JPEG that overflows a heap buffer, causing the target application to crash. Because the overflow occurs during image decoding, a remote attacker can trigger it without user interaction, such as when a system generates thumbnails for unknown files.

This flaw affects Red Hat Enterprise Linux versions 6, 7, 8, 9 and 10, as they ship the gdk‑pixbuf component that contains the vulnerable code. Any software on those platforms that processes JPEG images via gdk‑pixbuf is potentially impacted.

The CVSS score of 7.5 indicates a high‑severity threat. With EPSS data missing, the exact likelihood of exploitation is unclear, but the flaw is not listed in CISA's KEV catalog, suggesting no known widespread attacks yet. The exploitation path requires an attacker to provide a specially crafted JPEG, which can be delivered through automated thumbnail generation or other image processing routines. If successful, the system experiences application crashes leading to denial of service for the affected service or user session.