Is CVE-2026-81893 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-81893 being exploited in the wild.

How severe is CVE-2026-81893?

Medium severity, with a CVSS score of 4.7, published 27 August 2026.

Which products and versions are affected?

Gnome Gdk-Pixbuf 2.26.4 and later.

Is there a fix for CVE-2026-81893?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-81893 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-81893?

Check whether you run Gnome Gdk-Pixbuf at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-81893: gdk-pixbuf out-of-bounds write in JPEG ICC profile parser

CVE-2026-81893 · Severity: medium · CVSS 4.7 · Published 2026-08-27

gdk-pixbuf is a widely-used image library for loading and rendering JPEG, PNG, and other image formats. A crafted JPEG file with malformed ICC color profile data can cause the library to write memory beyond allocated bounds, crashing applications that process the image. Users can be exploited by simply opening or previewing a hostile image file.

Technologies: Gnome Gdk-Pixbuf. Vendors: Gnome.

Quick answers

Is CVE-2026-81893 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-81893 being exploited in the wild.
How severe is CVE-2026-81893?: Medium severity, with a CVSS score of 4.7, published 27 August 2026.
Which products and versions are affected?: Gnome Gdk-Pixbuf 2.26.4 and later.
Is there a fix for CVE-2026-81893?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-81893 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-81893?: Check whether you run Gnome Gdk-Pixbuf at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an out-of-bounds write (CWE-787) in the JPEG ICC profile parser. When processing a specially crafted JPEG with chunked ICC profile markers, an error during profile parsing leaves stale size metadata after the profile buffer is freed. A subsequent memory allocation in the same decode operation can trigger an out-of-bounds write. The attack requires no privileges or authentication and only requires the target application to load the malicious JPEG; user interaction is required to open/process the image. The flaw affects gdk-pixbuf versions 2.26.4 and later. A fix is available upstream in the gdk-pixbuf master branch.

Affected products

GNOME gdk-pixbuf 2.26.4 and later

Timeline

2026-08-27: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.