GNOME vulnerabilities
We track 53 vulnerabilities in GNOME products across 20 products. 53 are rated high or critical, and none are known to be exploited. The most recent was published on September 29, 2026.
Latest GNOME vulnerabilities
- 7.5 High severity
libxslt: Access of Resource Using Incompatible Type
A flaw was found in the libxslt library. The same memory field, psvi, is used for both stylesheet and input data, which can lead to type confusion during XML transformations. This vulnerability allows an attacker to crash the application or corrupt memory. In
- 7.5 High severity
libxml2: Expired Pointer Dereference
A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This flaw allows an attacker to craft a malicious XML input to libxml2, leading to a denial of service.
- 7.5 High severity
Red Hat Enterprise Linux 10: Integer Overflow or Wraparound
A flaw was found in how GLib’s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doe
- 7.4 High severity
Red Hat Enterprise Linux 8: URL Redirection to Untrusted Site
A flaw was found in Yelp. The Gnome user help application allows the help document to execute arbitrary scripts. This vulnerability allows malicious users to input help documents, which may exfiltrate user files to an external environment.
- 9.8 Critical severity
glib: Buffer Copy without Checking Size of Input
gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because SOCKS4_CONN_MSG_LEN is not sufficient for a trailing '\0' character.
- 7.5 High severity
libsoup: Inconsistent Interpretation of HTTP Requests
GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because '\0' characters at the end of header names are ignored, i.e., a "Transfer-Encoding\0: chunked" header is treated the same as a "Transfer-Encoding: chunked" header.
- 7.8 High severity
G Structured File Library (libgsf): Integer Overflow or Wraparound
An integer overflow vulnerability exists in the Compound Document Binary File format parser of v1.14.52 of the GNOME Project G Structured File Library (libgsf). A specially crafted file can result in an integer overflow that allows for a heap-based buffer over
- 7.8 High severity
G Structured File Library (libgsf): Integer Overflow or Wraparound
An integer overflow vulnerability exists in the Compound Document Binary File format parser of the GNOME Project G Structured File Library (libgsf) version v1.14.52. A specially crafted file can result in an integer overflow when processing the directory from
- 7.8 High severity
gdkpixbuf: Out-of-bounds Write
In GNOME GdkPixbuf (aka gdk-pixbuf) through 2.42.10, the ANI (Windows animated cursor) decoder encounters heap memory corruption (in ani_load_chunk in io-ani.c) when parsing chunks in a crafted .ani file. A crafted file could allow an attacker to overwrite hea
- 7.7 High severity
Red Hat Enterprise Linux 8: Protection Mechanism Failure
A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the tracker-extract process has first been compromised by a separate vulnerability.
- 7.8 High severity
Gnome-time Tracker: Improper Neutralization of Special Elements in Output Used by a Downstream Component
CSV Injection vulnerability in GNOME time tracker version 3.0.2, allows local attackers to execute arbitrary code via crafted .tsv file when creating a new record.
- 7.5 High severity
Epiphany: Exposure of Resource to Wrong Sphere
In Epiphany (aka GNOME Web) through 43.0, untrusted web content can trick users into exfiltrating passwords, because autofill occurs in sandboxed contexts.
- 7.5 High severity
Epiphany: Out-of-bounds Write
In GNOME Epiphany before 41.4 and 42.x before 42.2, an HTML document can trigger a client buffer overflow (in ephy_string_shorten in the UI process) via a long page title. The issue occurs because the number of bytes for a UTF-8 ellipsis character is not prope