Executive brief
gdk-pixbuf is a widely-used image library for loading and rendering JPEG, PNG, and other image formats. A crafted JPEG file with malformed ICC color profile data can cause the library to write memory beyond allocated bounds, crashing applications that process the image. Users can be exploited by simply opening or previewing a hostile image file.
Technical details
The vulnerability is an out-of-bounds write (CWE-787) in the JPEG ICC profile parser. When processing a specially crafted JPEG with chunked ICC profile markers, an error during profile parsing leaves stale size metadata after the profile buffer is freed. A subsequent memory allocation in the same decode operation can trigger an out-of-bounds write. The attack requires no privileges or authentication and only requires the target application to load the malicious JPEG; user interaction is required to open/process the image. The flaw affects gdk-pixbuf versions 2.26.4 and later. A fix is available upstream in the gdk-pixbuf master branch.
Affected products
- GNOME gdk-pixbuf 2.26.4 and later
Timeline
- 2026-08-27: disclosed