REDHAT-BUG-2524834: Medium severity gdk-pixbuf vulnerability
A flaw was found in gdk-pixbuf's JPEG loader (io-jpeg.c). When parsing chunked ICC profile data from JPEG APP2 markers, the error cleanup path in jpegparseexifapp2segment() frees the ICC profile buffer but previously failed to reset iccprofilesize and iccprofilesizeallocated. A specially crafted JPEG can trigger allocation, an error that frees the buffer while leaving stale size metadata, and a subsequent re-allocation that leads to an out-of-bounds write during ICC profile assembly.
The issue was introduced when error cleanup was added for chunked ICC profile handling in gdk-pixbuf 2.43.4/2.44.0 (commit 4af78023). It is fixed upstream in commit efe658674bd103d1c9bf50809d5767a3f6dd5a01 ("jpeg: When freeing memory, unset the size"), merged via https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/mergerequests/278 on 2026-08-24. No fixed upstream release tag exists yet.
Red Hat tracking: PSIRTSUPT-22558.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
gdk-pixbufto a version that resolves this vulnerability.Patch efe658674bd103d1c9bf50809d5767a3f6dd5a01
Event History
Frequently Asked Questions
Which deployments are affected?
The flaw was introduced in gdk-pixbuf 2.43.4/2.44.0 when error cleanup for chunked ICC profile handling was added. The provided data does not identify a fixed upstream release tag.
What must an attacker provide to trigger the issue?
An attacker needs a specially crafted JPEG containing chunked ICC profile data in JPEG APP2 markers. The malformed data must be processed by gdk-pixbuf's JPEG loader.
How is the issue fixed upstream?
Upstream fixed the stale metadata cleanup by resetting ICC profile size fields when the ICC profile buffer is freed. The fix is commit efe658674bd103d1c9bf50809d5767a3f6dd5a01, merged on 2026-08-24.