JLSEC-2026-455

See a problem?
Please try reporting it to the source first.

Source

https://github.com/JuliaLang/SecurityAdvisories.jl/blob/main/advisories/published/2026/JLSEC-2026-455.md

Import Source

https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-455.json

JSON Data

https://api.osv.dev/v1/vulns/JLSEC-2026-455

Upstream

CVE-2019-1010238
EUVD-2019-1980
GHSA-wwvc-98fq-c42m

Published

2026-05-07T14:27:30Z

Modified

2026-07-25T18:24:29Z

Severity

7.5 CVSS_V2 - AV:N/AC:L/Au:N/C:P/I:P/A:P CVSS Calculator
9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Gnome Pango 1.42 and later is affected by: Buffer Overflow

Details

Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels, assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass invalid utf-8 strings to functions like pango_itemize.

Database specific

{
    "license":  "CC-BY-4.0",
    "sources":  [
        {
            "database_specific":  {
                "status":  "Modified"
            },
            "html_url":  "https://nvd.nist.gov/vuln/detail/CVE-2019-1010238",
            "id":  "CVE-2019-1010238",
            "imported":  "2026-07-17T21:55:47.011Z",
            "modified":  "2026-06-17T02:09:53.650Z",
            "published":  "2019-07-19T17:15:11.690Z",
            "url":  "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2019-1010238"
        },
        {
            "html_url":  "https://github.com/advisories/GHSA-wwvc-98fq-c42m",
            "id":  "GHSA-wwvc-98fq-c42m",
            "imported":  "2026-07-17T21:55:47.160Z",
            "modified":  "2024-04-04T01:18:58Z",
            "published":  "2022-05-24T16:50:42Z",
            "url":  "https://api.github.com/advisories/GHSA-wwvc-98fq-c42m"
        },
        {
            "html_url":  "https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-1980",
            "id":  "EUVD-2019-1980",
            "imported":  "2026-07-17T21:55:51.497Z",
            "modified":  "2024-08-05T03:07:18Z",
            "published":  "2019-07-19T16:42:41Z",
            "url":  "https://euvdservices.enisa.europa.eu/api/enisaid?id=EUVD-2019-1980"
        }
    ]
}

References

Affected packages

Julia / Pango_jll

Package

Name: Pango_jll
Purl: pkg:julia/Pango_jll?uuid=36c8627f-9965-5494-a995-c6b170f724f3

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.47.0+0

Database specific

source

"https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-455.json"