CVE-2026-81893: Gdk-pixbuf: gdk-pixbuf: invalid write in jpeg icc profile parser on error recovery
A flaw was found in gdk-pixbuf. When loading a specially crafted JPEG image containing chunked ICC profile markers, an error during ICC profile parsing can leave stale size metadata after the profile buffer is freed. A subsequent allocation in the same decode can cause an out-of-bounds write, potentially crashing the application. To exploit this flaw, an application using gdk-pixbuf must process the malicious JPEG image.
Affected version >= 2.26.4
Other sources
A flaw was found in gdk-pixbuf's JPEG loader (io-jpeg.c). When parsing chunked ICC profile data from JPEG APP2 markers, the error cleanup path in jpegparseexifapp2segment() frees the ICC profile buffer but previously failed to reset iccprofilesize and iccprofilesizeallocated. A specially crafted JPEG can trigger allocation, an error that frees the buffer while leaving stale size metadata, and a subsequent re-allocation that leads to an out-of-bounds write during ICC profile assembly.
The issue was introduced when error cleanup was added for chunked ICC profile handling in gdk-pixbuf 2.43.4/2.44.0 (commit 4af78023). It is fixed upstream in commit efe658674bd103d1c9bf50809d5767a3f6dd5a01 ("jpeg: When freeing memory, unset the size"), merged via https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/mergerequests/278 on 2026-08-24. No fixed upstream release tag exists yet.
Red Hat tracking: PSIRTSUPT-22558.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
gdk-pixbufto a version that resolves this vulnerability.Patch efe658674bd103d1c9bf50809d5767a3f6dd5a01 - Compensating control
Mitigate by preventing or limiting processing of untrusted/specially crafted JPEG images that trigger the gdk-pixbuf JPEG ICC profile parser error during decode.
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using gdk-pixbuf's JPEG loader are exposed when they process a specially crafted JPEG containing chunked ICC profile data. Exploitation requires local access and user interaction, as reflected by the AV:L and UI:R metrics.
Are all listed affected versions vulnerable?
The issue is listed as affecting versions 2.26.4 and later, but the vulnerable error-cleanup behavior was introduced in gdk-pixbuf 2.43.4/2.44.0. The provided data identifies upstream commit efe658674bd103d1c9bf50809d5767a3f6dd5a01 as the fix.
What is the expected impact of successful exploitation?
A crafted image can cause an out-of-bounds write during ICC profile assembly, potentially crashing the application. The supplied severity vector indicates no confidentiality or integrity impact and a high availability impact.