CVE-2019-20326

A heap-based buffer overflow in _cairo_image_surface_create_from_jpeg() in extensions/cairo_io/cairo-image-surface-jpeg.c in GNOME gThumb before 3.8.3 and Linux Mint Pix before 2.4.5 allows attackers to cause a crash and potentially execute arbitrary code via a crafted JPEG file.

• CWE-787

• https://github.com/Fysac/CVE-2019-20326Exploit, Third Party Advisory
• https://gitlab.gnome.org/GNOME/gthumb/commit/4faa5ce2358812d23a1147953ee76f59631590adPatch, Vendor Advisory
• https://gitlab.gnome.org/GNOME/gthumb/commit/ca8f528209ab78935c30e42fe53bdf1a24f3cb44Vendor Advisory
• https://gitlab.gnome.org/GNOME/gthumb/commits/master/extensions/cairo_io/cairo-image-surface-jpeg.cVendor Advisory
• https://lists.debian.org/debian-lts-announce/2021/08/msg00027.htmlMailing List, Third Party Advisory
• https://security.gentoo.org/glsa/202008-05Third Party Advisory
• https://github.com/Fysac/CVE-2019-20326Exploit, Third Party Advisory
• https://gitlab.gnome.org/GNOME/gthumb/commit/4faa5ce2358812d23a1147953ee76f59631590adPatch, Vendor Advisory
• https://gitlab.gnome.org/GNOME/gthumb/commit/ca8f528209ab78935c30e42fe53bdf1a24f3cb44Vendor Advisory
• https://gitlab.gnome.org/GNOME/gthumb/commits/master/extensions/cairo_io/cairo-image-surface-jpeg.cVendor Advisory
• https://lists.debian.org/debian-lts-announce/2021/08/msg00027.htmlMailing List, Third Party Advisory
• https://security.gentoo.org/glsa/202008-05Third Party Advisory

Published

Mar 16, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-20320Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-20321Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-20322Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-20323Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-20324Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-20325Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-20327Insecure permissions in cwrapper_perl in Centreon Infrastruc…7.8
• CVE-2019-20329OpenLambda 2019-09-10 allows DNS rebinding attacks against t…8.1
• CVE-2019-2033In create_hdr of dnssd_clientstub.c, there is a possible use…
• CVE-2019-20330FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain…9.8
• CVE-2019-20334In Netwide Assembler (NASM) 2.14.02, stack consumption occur…5.5
• CVE-2019-20336In PHP Scripts Mall advanced-real-estate-script 4.0.9, the s…6.1