# CVE-2026-16768: GNOME gdk-pixbuf out-of-bounds read in ICO parser

Source: https://junglewise.ai/threats/cve-2026-16768-gnome-gdk-pixbuf-out-of-bounds-read-in-ico-parser  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-23. Updated: 2026-07-23  
License: CC BY 4.0 with a link back

CVE-2026-16768 · Severity: medium · CVSS 5.3 · Published 2026-07-23

A vulnerability exists in gdk-pixbuf, a widely used library for loading and manipulating images on Linux systems. By providing a specially crafted icon (ICO) file, an attacker can cause the system to leak sensitive information from its memory. This information is converted into image pixels, which could allow an attacker to see private data by viewing a generated thumbnail or processed version of the malicious image.

Technologies: [Gnome Gdk-Pixbuf](https://junglewise.ai/threats/technologies/gdk-pixbuf). Vendors: [Gnome](https://junglewise.ai/threats/vendors/gnome).

## Quick answers

**Is CVE-2026-16768 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-16768 being exploited in the wild.

**How severe is CVE-2026-16768?** Medium severity, with a CVSS score of 5.3, published 23 July 2026.

**Which products and versions are affected?** Gnome Gdk-Pixbuf 6, 7, 8, 9, 10.

**Is there a fix for CVE-2026-16768?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-16768 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-16768?** Check whether you run Gnome Gdk-Pixbuf at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds read vulnerability exists in the ICO image parser of gdk-pixbuf within the io-ico.c component. The functions OneLine8(), OneLine4(), and OneLine1() fail to validate pixel values against the actual palette size (biClrUsed) before using them as indices to access the palette buffer. An attacker can provide a crafted ICO file where pixel values exceed the palette range, causing the library to read adjacent heap memory. These leaked heap bytes are then rendered as RGB values in the resulting image output, allowing for remote information disclosure if an attacker can retrieve the processed image or its thumbnail.

## Affected products

- Red Hat gdk-pixbuf2 6, 7, 8, 9, 10
- GNOME gdk-pixbuf All versions

## Timeline

- 2026-07-23: disclosed: Initial report in GNOME GitLab and Red Hat Bugzilla
- 2026-07-23: advisory: NVD published CVE-2026-16768

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-16768](https://access.redhat.com/security/cve/CVE-2026-16768)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2506437](https://bugzilla.redhat.com/show_bug.cgi?id=2506437)
- [https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/302](https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/302)

## Related threats

- [gdk-pixbuf heap out-of-bounds read in ICNS decompression](https://junglewise.ai/threats/cve-2026-18090-gdk-pixbuf-heap-out-of-bounds-read-in-icns-decompression)
- [gdk-pixbuf out-of-bounds write in JPEG ICC profile parser](https://junglewise.ai/threats/cve-2026-81893-gdk-pixbuf-out-of-bounds-write-in-jpeg-icc-profile-parser)
- [GNOME gdk-pixbuf heap buffer overflow in JPEG loading](https://junglewise.ai/threats/cve-2025-7345-gnome-gdk-pixbuf-heap-buffer-overflow-in-jpeg-loading)