Critical Command Injection Vulnerability in Fedora's perl-GD Library

A critical command injection vulnerability (CVE-2026-11526) was discovered in the perl-GD library used in Fedora 43 and Fedora 44. This flaw arises from the use of the 2-argument form of the open function, which can be exploited to execute arbitrary commands. The vulnerability was published on June 14, 2026, and affects users of the perl-GD library across both Fedora versions. The issue has been addressed in updates released on June 9, 2026, with users urged to apply the patches immediately. The updates can be installed using the 'dnf' package manager. Failure to update may leave systems vulnerable to exploitation. The affected library is widely used for creating and manipulating PNG files, making the impact potentially significant for applications relying on it.

Key Points: • CVE-2026-11526 is a critical command injection vulnerability affecting perl-GD. • The flaw allows arbitrary command execution via the 2-argument open function. • Users are urged to update to the patched versions in Fedora 43 and 44 immediately.