CVE-2026-16768

A flaw was found in gdk-pixbuf. When parsing a specially crafted ICO file with pixel values that exceed the defined palette range, an out-of-bounds read can occur due to improper bounds checking against the actual palette size. This vulnerability causes heap bytes to be interpreted as valid palette indices and rendered as RGB pixel values in the output image, allowing an attacker to extract heap content via the generated output, such as a thumbnail.

To exploit this flaw, an attacker must be able to process a specially crafted ICO file with an application linked to the gdk-pixbuf library. The only security impact of this issue is an information leak of memory contents via the generated output, such as a thumbnail. Also, the attacker does not have full control of the information obtained, further limiting its impact. Due to these reasons, this vulnerability has been rated with a moderate severity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, if the application does not require support for ICO files, disable the gdk-pixbuf ICO loader to prevent the vulnerable module from being executed.