Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

Gnome — Vulnerabilities & Security Advisories 59

Browse all 59 CVE security advisories affecting Gnome. AI-powered Chinese analysis, POCs, and references for each vulnerability.

GNOME serves as a default desktop environment for Linux distributions, providing a user interface for system interaction. Historically, it has faced vulnerabilities across multiple classes, including remote code execution, cross-site scripting, and privilege escalation, with 17 CVEs documented. Security concerns have often centered on components like GNOME Shell and related utilities. Notable incidents include flaws in the Epiphany browser and Nautilus file manager that could lead to information disclosure or arbitrary code execution. The project has addressed these through regular updates, but the complexity of its ecosystem continues to present potential attack surfaces for malicious actors targeting Linux systems.

Top products by Gnome: GIMP glib gvfs Gdk-Pixbuf libsoup libxml2 NetworkManager-vpnc Dia Evolution Data Server NetworkManager-sstp NetworkManager-iodine NetworkManager-fortisslvpn Gnumeric evolution-data-server Epiphany gnome-remote-desktop libgxps librest Ekiga malcontent Fonts Viewer libxslt GDM3 gvdb Pango gdm Evolution NetworkManager
CVE ID Title CVSS Severity Published
CVE-2026-111132 GNOME libgxps through 0.3.2 Heap Out-of-Bounds Read via path_geometry_start_element — libgxps CWE-125 6.1 Medium 2026-10-15
CVE-2026-110777 Evolution-data-server: local file disclosure via attach file:// uris — evolution-data-server CWE-200 5.7 Medium 2026-10-14
CVE-2026-91841 Networkmanager-vpnc: networkmanager-vpnc: incomplete fix for cve-2018-10900 allows root privilege escalation via ca-file path newline injection — NetworkManager-vpnc CWE-93 7.8 High 2026-09-25
CVE-2026-91840 Networkmanager-vpnc: networkmanager-vpnc: local privilege escalation to root via newline injection in vpn username — NetworkManager-vpnc CWE-93 7.8 High 2026-09-25
CVE-2026-91839 Networkmanager-fortisslvpn: networkmanager-fortisslvpn: local privilege escalation to root via crlf injection in vpn profile credentials — NetworkManager-fortisslvpn CWE-93 7.8 High 2026-09-25
CVE-2026-91838 Networkmanager-sstp: networkmanager-sstp: local privilege escalation to root via shell injection in vpn profile fields — NetworkManager-sstp CWE-78 7.8 High 2026-09-25
CVE-2026-91837 Networkmanager-iodine: networkmanager-iodine: local privilege escalation to root via nameserver option injection — NetworkManager-iodine CWE-78 7.8 High 2026-09-25
CVE-2026-97222 Gnumeric: gnumeric: heap use-after-free when opening a malformed workbook — Gnumeric CWE-416 5.5 Medium 2026-09-25
CVE-2026-92248 Gimp: integer overflow when generating a thumbnail preview for a psd file — GIMP CWE-190 7.8 High 2026-09-15
CVE-2026-88924 Gvfs: gvfs-admin socket ownership race permits local root — gvfs CWE-367 7.0 High 2026-09-10
CVE-2026-84270 Gvfs: mtp: out-of-bounds read in do_read() — gvfs CWE-125 4.3 Medium 2026-09-01
CVE-2026-84269 Gvfs: afp: heap-based buffer overflow in dsi read path — gvfs CWE-122 6.5 Medium 2026-09-01
CVE-2026-84267 Gvfs: sftp: uninitialized heap disclosure in read_string() — gvfs CWE-908 4.3 Medium 2026-09-01
CVE-2026-84268 Gvfs: sftp: heap-based buffer overflow in read_reply() — gvfs CWE-122 8.8 High 2026-09-01
CVE-2026-82343 Gimp: heap out-of-bounds read and stack out-of-bounds access in psd loader from channel-count handling — GIMP CWE-120 6.1 Medium 2026-08-28
CVE-2026-82330 Gimp: heap out-of-bounds read in pvr vq (compressed) decoder due to missing bounds check — GIMP CWE-125 6.1 Medium 2026-08-28
CVE-2026-82328 Gimp: heap out-of-bounds read in ico loader via unvalidated used_clrs palette count — GIMP CWE-125 6.1 Medium 2026-08-28
CVE-2026-82324 Gimp: heap out-of-bounds reads in iff/ilbm loader from ham row size mismatch and nplanes=0 — GIMP CWE-125 6.1 Medium 2026-08-28
CVE-2026-77652 Dia: dia: heap buffer overflow in wpg colormap parser via out-of-bounds palette index — Dia CWE-122 7.8 High 2026-08-26
CVE-2026-79902 Gimp: stack vla size underflow denial of service in seattle — GIMP CWE-190 5.5 Medium 2026-08-26
CVE-2026-77658 Dia: dia: stack buffer overflow in bus object via unvalidated handle count in project files — Dia CWE-121 7.8 High 2026-08-26
CVE-2026-80101 Gimp: multiple heap out-of-bounds reads in xwd loader from unrelated width and bytes-per-line validation — GIMP CWE-125 4.4 Medium 2026-08-25
CVE-2026-78475 Gimp: unbounded stack vla and 21-byte stack over-read in pix (esm) loader — GIMP CWE-125 6.1 Medium 2026-08-24
CVE-2026-78465 Gimp: integer overflow in pcx loader (planes=4) leads to heap overflow on 32-bit — GIMP CWE-190 7.0 High 2026-08-24
CVE-2026-18487 Epiphany: address bar / host spoofing via userinfo in ephy_uri_get_decoded_host() — Epiphany CWE-451 5.4 Medium 2026-08-06
CVE-2026-18358 Gnome-remote-desktop: gnome-remote-desktop system-mode rdp server missing connection throttling allows unauthenticated denial of service — gnome-remote-desktop CWE-400 7.5 High 2026-07-31
CVE-2026-66759 Gimp: out-of-bounds read in file-icns plugin causes information disclosure or crash on crafted icns images — GIMP CWE-125 7.1 High 2026-07-27
CVE-2026-66758 Gimp: integer overflow in file-fits plugin causes a heap-based buffer overflow on crafted fits images — GIMP CWE-190 7.8 High 2026-07-27
CVE-2026-66757 Gimp: signed integer overflow in file-sgi (sgi-lib) causes the plugin to crash on rle sgi images — GIMP CWE-190 5.5 Medium 2026-07-27
CVE-2026-16768 Gdk-pixbuf: out-of-bounds read in ico parser — gdk-pixbuf CWE-125 5.3 Medium 2026-07-23

This page lists every published CVE security advisory associated with Gnome. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.