| Name | CVE-2026-16768 |
| Description | A flaw was found in gdk-pixbuf. When parsing a specially crafted ICO file with pixel values that exceed the defined palette range, an out-of-bounds read can occur due to improper bounds checking against the actual palette size. This vulnerability causes heap bytes to be interpreted as valid palette indices and rendered as RGB pixel values in the output image, allowing an attacker to extract heap content via the generated output, such as a thumbnail. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| Debian Bugs | 1143155 |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| gdk-pixbuf (PTS) | bookworm, bookworm (security) | 2.42.10+dfsg-1+deb12u4 | vulnerable |
| trixie (security), trixie | 2.42.12+dfsg-4+deb13u1 | vulnerable |
| forky | 2.44.7+dfsg-1 | vulnerable |
| sid | 2.44.8+dfsg-1 | vulnerable |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|
| gdk-pixbuf | source | (unstable) | (unfixed) | | | 1143155 |
Notes
[trixie] - gdk-pixbuf <postponed> (Minor issue, revisit when/if a fix is available for the C-based legacy implementation)
[bookworm] - gdk-pixbuf <postponed> (Minor issue; bounded OOB read in the ICO palette lookup in OneLine8()/OneLine4(), leaks heap bytes into the rendered image; unfixed upstream)
[bullseye] - gdk-pixbuf <postponed> (Minor issue; bounded OOB read in the ICO palette lookup in OneLine8()/OneLine4(), leaks heap bytes into the rendered image; unfixed upstream)
https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/302
https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/merge_requests/279
Since gdk-pixbuf >= 2.44.5+dfsg-3 gdk-pixbuf loads most image formats using glycin