CVE-2025-26416
Public on 2025-09-02
Modified on 2026-10-02
Description
In initializeSwizzler of SkBmpStandardCodec.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3 Base Score
See breakdown
Affected Packages
| Platform | Package | Release Date | Advisory | Status |
|---|---|---|---|---|
| Amazon Linux 2 - Firefox Extra | firefox | Not Affected | ||
| Amazon Linux 2023 | firefox | Not Affected | ||
| Amazon Linux 2027 Preview | firefox | Not Affected | ||
| Amazon Linux 2 - Core | gtk2 | Not Affected | ||
| Amazon Linux 2 - Core | gtk3 | Not Affected | ||
| Amazon Linux 2023 | gtk3 | Not Affected | ||
| Amazon Linux 2027 Preview | gtk3 | Not Affected | ||
| Amazon Linux 2023 | gtk4 | Not Affected | ||
| Amazon Linux 2027 Preview | gtk4 | Not Affected | ||
| Amazon Linux 2 - Core | thunderbird | Not Affected | ||
| Amazon Linux 2 - Core | webkitgtk3 | No Fix Planned | ||
| Amazon Linux 2 - Core | webkitgtk4 | 2026-10-12 | ALAS2-2026-3987 | Fixed |
CVSS Scores
| Score Type | Score | Vector | |
|---|---|---|---|
| Amazon Linux | CVSSv3 | 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |