CVE-2026-5201 is a heap-based buffer overflow vulnerability in the gdk-pixbuf2 library's JPEG image loader. The vulnerability arises from improper validation of color component counts when processing maliciously crafted JPEG images. This can be exploited remotely without user interaction, for example during thumbnail generation, leading to application crashes and denial of service. Red Hat Enterprise Linux versions 9 (up to but not including 9.8) and 10 (up to but not including 10.2) are affected. Red Hat has issued security advisories RHSA-2026:10707 and RHSA-2026:10708 providing updated gdk-pixbuf2 packages that fix this vulnerability across multiple architectures including x86_64, s390x, ppc64le, and aarch64.

Successful exploitation of this vulnerability results in denial of service conditions due to application crashes. There is no indication of confidentiality or integrity impact. The vulnerability can be triggered remotely without user interaction, increasing the risk of automated attacks. No known exploits in the wild have been reported at this time.

Red Hat has released official security updates that fix this vulnerability. Users should apply the updated gdk-pixbuf2 packages as provided in Red Hat advisories RHSA-2026:10707 for RHEL 10 and RHSA-2026:10708 for RHEL 9. Detailed update instructions are available at https://access.redhat.com/articles/11258. Applying these updates mitigates the vulnerability. No additional action is required beyond applying the official patches.