BlackTreeIndependent security intelligenceUnknown · Unknown
High technical severity; prioritise exposed affected systems while verifying vendor guidance.
Canonical’s release and source-package findings are shown separately from local repository availability.
A published vendor fix does not prove that a matching update is enabled and installable on a particular asset. Confirm the local package candidate before scheduling remediation.
| Ubuntu release | Source package | Vendor state | Fixed version | Evidence |
|---|---|---|---|---|
| Ubuntu 24.04 LTSnoble · standard archive | gtk+2.0 | Vendor fix publishedCanonical reports that a fixed source package version has been published. Repository candidate availability is not checked by BlackTree. | 2.24.33-4ubuntu1.1 | Canonical record ↗Source updated 10 Sept 2026 |
| Ubuntu 24.04 LTSnoble · standard archive | gtk+3.0 | Vendor fix publishedCanonical reports that a fixed source package version has been published. Repository candidate availability is not checked by BlackTree. | 3.24.41-4ubuntu1.1 | Canonical record ↗Source updated 10 Sept 2026 |
High technical severity; prioritise exposed affected systems while verifying vendor guidance.
Patch availableA flaw was found in the GTK library. Under certain conditions, it is possible for a library to be injected into a GTK application from the current working directory.
A flaw was found in the GTK library. Under certain conditions, it is possible for a library to be injected into a GTK application from the current working directory.
Untrusted data can cross into a code-evaluation path and be interpreted as executable instructions.
An attacker operating through local access may attempt exploitation without authentication after a user interaction. If successful, the issue may cause the confidentiality, integrity or availability impact described by the vendor.
A flaw was found in the GTK library. Under certain conditions, it is possible for a library to be injected into a GTK application from the current working directory.
Untrusted data can cross into a code-evaluation path and be interpreted as executable instructions.
An attacker operating through local access may attempt exploitation without authentication after a user interaction. If successful, the issue may cause the confidentiality, integrity or availability impact described by the vendor.
CVSS severity, EPSS forecast probability, public exploit material and CISA-confirmed exploitation are separate signals.
No CISA KEV match was present at the last successful refresh. This means no confirmation from that source, not proof of no exploitation.
No exploit-tagged reference or CISA SSVC proof-of-concept state is currently recorded. Research may still exist outside the structured feeds.
CWE-94: Improper Control of Generation of Code ('Code Injection'). The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HCommon Vulnerability Scoring System 3.1: the compact vector below is decoded into plain language.
Operational remediation based on structured source evidence.
Published 16 Jul 2024 · Last source change 20 Nov 2025, 19:54 UTC · CWE-94 · Improper Control of Generation of Code ('Code Injection')
Missing structured fields: affected product. Missing data is not evidence of low risk; review the primary advisory.
No material field changes have been recorded since change tracking began. Routine source refreshes and cosmetic edits are intentionally excluded.