CVE-2026-16768: Gdk-pixbuf: out-of-bounds read in ico parser
A flaw was found in gdk-pixbuf, affecting all versions. When parsing a specially crafted ICO file with pixel values that exceed the defined palette range, an out-of-bounds read can occur due to improper bounds checking against the actual palette size. This issue causes heap bytes to be interpreted as valid palette indices and rendered as RGB pixel values in the output image, allowing an attacker to extract heap contents via the generated output, such as a thumbnail.
Other sources
A flaw was found in gdk-pixbuf. When parsing a specially crafted ICO file with pixel values that exceed the defined palette range, an out-of-bounds read can occur due to improper bounds checking against the actual palette size. This vulnerability causes heap bytes to be interpreted as valid palette indices and rendered as RGB pixel values in the output image, allowing an attacker to extract heap content via the generated output, such as a thumbnail.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-16768?
The severity of CVE-2026-16768 is medium with a score of 5.3.
How does CVE-2026-16768 affect Gdk-pixbuf?
CVE-2026-16768 can lead to an out-of-bounds read when parsing specially crafted ICO files, causing potential information disclosure.
How do I fix CVE-2026-16768?
To fix CVE-2026-16768, update Gdk-pixbuf to the latest version where the vulnerability has been addressed.
What type of vulnerability is CVE-2026-16768?
CVE-2026-16768 is classified as an out-of-bounds read vulnerability.
Who is affected by CVE-2026-16768?
CVE-2026-16768 affects users of Gnome GDK-PixBuf that process ICO files.