CVE-2026-16768
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
An out-of-bounds read vulnerability was found in the gdk-pixbuf library when parsing a specially crafted ICO file with pixel values exceeding the defined palette range. An attacker can extract heap content via the generated output, such as a thumbnail.
Risk Assessment
An attacker can read heap memory data, potentially leading to leakage of sensitive information.
Recommendation
Update the gdk-pixbuf library to the latest version containing the fix.
Other vulnerabilities in gdk-pixbuf
See all- CVE-2017-2870High
An exploitable integer overflow vulnerability exists in the tiff_image_parse functionality of Gdk-Pixbuf 2.36.6 when compiled with Clang. A specially crafted tiff file can cause a heap-overflow resulting in remote code execution.
- CVE-2017-2862High
A heap overflow vulnerability exists in the gdk_pixbuf__jpeg_image_load_increment functionality of Gdk-Pixbuf 2.36.6. A specially crafted jpeg file can cause a heap overflow resulting in remote code execution.
- CVE-2017-6313High
An integer underflow in the load_resources function in io-icns.c in gdk-pixbuf can be exploited by context-dependent attackers to cause a denial of service through a crafted image entry size in an ICO file.
- CVE-2017-6311High
The gdk-pixbuf-thumbnailer.c file in gdk-pixbuf contains a vulnerability that allows context-dependent attackers to cause a denial of service through a NULL pointer dereference, leading to application crashes.
- CVE-2016-6352High
The OneLine32 function in io-ico.c in gdk-pixbuf before version 2.35.3 allows remote attackers to cause a denial of service (out-of-bounds write and crash) via crafted dimensions in an ICO file.
- CVE-2015-8875High
Multiple integer overflows in the pixops_composite_nearest, pixops_composite_color_nearest, and pixops_process functions in gdk-pixbuf before version 2.33.1 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted image.
- CVE-2015-7552High
Heap-based buffer overflow in the gdk_pixbuf_flip function in gdk-pixbuf-scale.c in gdk-pixbuf 2.30.x allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted BMP file.
- CVE-2026-81893Medium
A flaw was found in gdk-pixbuf. When loading a specially crafted JPEG image containing chunked ICC profile markers, an error during ICC profile parsing can leave stale size metadata after the profile buffer is freed. A subsequent allocation in the same decode can cause an out-of-bounds write, potentially crashing the application. To exploit this flaw, an application using gdk-pixbuf must process the malicious JPEG image. Affected version >= 2.26.4.
- CVE-2026-5201High
A heap-based buffer overflow vulnerability was found in the gdk-pixbuf library's JPEG image loader due to improper validation of color component counts when processing a specially crafted JPEG image. A remote attacker can exploit this flaw without user interaction, for example, via thumbnail generation, leading to application crashes and denial of service (DoS).
- CVE-2025-7345High
A heap buffer overflow vulnerability has been discovered in the gdk-pixbuf and glib libraries when processing maliciously crafted JPEG images. The flaw resides in the gdk_pixbuf__jpeg_image_load_increment and g_base64_encode_step functions, potentially allowing out-of-bounds reads from heap memory.
Original NVD description (English source)
A flaw was found in gdk-pixbuf. When parsing a specially crafted ICO file with pixel values that exceed the defined palette range, an out-of-bounds read can occur due to improper bounds checking against the actual palette size. This vulnerability causes heap bytes to be interpreted as valid palette indices and rendered as RGB pixel values in the output image, allowing an attacker to extract heap content via the generated output, such as a thumbnail.