CVE-2004-0782

CVE-2004-0782 is a high-severity vulnerability in Gnome Gdkpixbuf with a CVSS 2.0 base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

• Severity: High (CVSS 2.0 base score 7.5)
• EPSS exploit prediction: 9% (95th percentile)
• Actively exploited: Not listed in CISA KEV
• Affected product: Gnome Gdkpixbuf
• Published: 2004-10-20
• Last modified: 2026-06-16

Description

Integer overflow in pixbuf_create_from_xpm (io-xpm.c) in the XPM image decoder for gtk+ 2.4.4 (gtk2) and earlier, and gdk-pixbuf before 0.22, allows remote attackers to execute arbitrary code via certain n_col and cpp values that enable a heap-based buffer overflow. NOTE: this identifier is ONLY for gtk+. It was incorrectly referenced in an advisory for a different issue (CVE-2004-0687).

Frequently asked questions

What is CVE-2004-0782?

Integer overflow in pixbuf_create_from_xpm (io-xpm.c) in the XPM image decoder for gtk+ 2.4.4 (gtk2) and earlier, and gdk-pixbuf before 0.22, allows remote attackers to execute arbitrary code via certain n_col and cpp values that enable a heap-based buffer overflow. NOTE: this identifier is ONLY for gtk+. It was incorrectly referenced in an advisory for a different issue (CVE-2004-0687).

How severe is CVE-2004-0782?

CVE-2004-0782 has a CVSS 2.0 base score of 7.5, rated high severity.

Is CVE-2004-0782 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 9% (95th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2004-0782?

CVE-2004-0782 primarily affects Gnome Gdkpixbuf. In total, 9 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2004-0782?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2004-0782 published?

CVE-2004-0782 was published on 2004-10-20 and last updated on 2026-06-16.

References

• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000875
• http://marc.info/?l=bugtraq&m=109528994916275&w=2
• http://scary.beasts.org/security/CESA-2004-005.txt
• http://secunia.com/advisories/17657
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-101776-1
• http://www.debian.org/security/2004/dsa-546
• http://www.kb.cert.org/vuls/id/729894
• http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:095
• http://www.mandriva.com/security/advisories?name=MDKSA-2005:214
• http://www.redhat.com/support/errata/RHSA-2004-447.html
• http://www.redhat.com/support/errata/RHSA-2004-466.html
• http://www.securityfocus.com/archive/1/419771/100/0/threaded
• http://www.securityfocus.com/bid/11195
• https://bugzilla.fedora.us/show_bug.cgi?id=2005
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17386
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11539
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1617

Affected products (9)

• cpe:2.3:a:gnome:gdkpixbuf:0.17:*:*:*:*:*:*:*
• cpe:2.3:a:gnome:gdkpixbuf:0.18:*:*:*:*:*:*:*
• cpe:2.3:a:gnome:gdkpixbuf:0.20:*:*:*:*:*:*:*
• cpe:2.3:a:gnome:gdkpixbuf:0.22:*:*:*:*:*:*:*
• cpe:2.3:a:gnome:gtk:2.0.2:*:*:*:*:*:*:*
• cpe:2.3:a:gnome:gtk:2.0.6:*:*:*:*:*:*:*
• cpe:2.3:a:gnome:gtk:2.2.1:*:*:*:*:*:*:*
• cpe:2.3:a:gnome:gtk:2.2.3:*:*:*:*:*:*:*
• cpe:2.3:a:gnome:gtk:2.2.4:*:*:*:*:*:*:*

More vulnerabilities in Gnome Gdkpixbuf

• CVE-2021-44648 — High (CVSS 8.8): GNOME gdk-pixbuf 2.42.6 is vulnerable to a heap-buffer overflow vulnerability when decoding the lzw compressed stream…
• CVE-2022-48622 — High (CVSS 7.8): In GNOME GdkPixbuf (aka gdk-pixbuf) through 2.42.10, the ANI (Windows animated cursor) decoder encounters heap memory…
• CVE-2005-2975 — High (CVSS 7.8): io-xpm.c in the gdk-pixbuf XPM image rendering library in GTK+ before 2.8.7 allows attackers to cause a denial of…
• CVE-2005-2976 — High (CVSS 7.5): Integer overflow in io-xpm.c in gdk-pixbuf 0.22.0 in GTK+ before 2.8.7 allows attackers to cause a denial of service…
• CVE-2005-3186 — High (CVSS 7.5): Integer overflow in the GTK+ gdk-pixbuf XPM image rendering library in GTK+ 2.4.0 allows attackers to execute arbitrary…
• CVE-2004-0783 — High (CVSS 7.5): Stack-based buffer overflow in xpm_extract_color (io-xpm.c) in the XPM image decoder for gtk+ 2.4.4 (gtk2) and earlier,…

All CVEs affecting Gnome Gdkpixbuf →