{"id":"CVE-2026-16768","title":"Gdk-pixbuf: out-of-bounds read in ico parser","summary":"A flaw was found in gdk-pixbuf. When parsing a specially crafted ICO file with pixel values that exceed the defined palette range, an out-of-bounds read can occur due to improper bounds checking against the actual palette size. This vuln…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvssSource":"cna","cwe":["CWE-125"],"vendor":"GNOME","product":"gdk-pixbuf","affected":["gdk-pixbuf (all versions)","gdk-pixbuf2 (all versions)","gdk-pixbuf2 (all versions)","gdk-pixbuf2 (all versions)","gdk-pixbuf2 (all versions)","gdk-pixbuf2 (all versions)"],"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-07-23T17:49:43.531984Z"},"exploitAvailable":true,"published":"2026-07-23","updated":"2026-11-05","sourceUpdated":"2026-11-05T19:24:21.288Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-16768","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-16768"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506437","label":"RHBZ#2506437"},{"url":"https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/302"}],"tags":["cve.org","exploit-available"],"epss":0.00405,"epssPercentile":0.35046,"ingestedAt":"2026-11-05T22:38:31.536Z","slug":"CVE-2026-16768","body":"## Overview\n\nA flaw was found in gdk-pixbuf. When parsing a specially crafted ICO file with pixel values that exceed the defined palette range, an out-of-bounds read can occur due to improper bounds checking against the actual palette size. This vulnerability causes heap bytes to be interpreted as valid palette indices and rendered as RGB pixel values in the output image, allowing an attacker to extract heap content via the generated output, such as a thumbnail.\n\n## Affected\n\n- `gdk-pixbuf (all versions)`\n- `gdk-pixbuf2 (all versions)`\n- `gdk-pixbuf2 (all versions)`\n- `gdk-pixbuf2 (all versions)`\n- `gdk-pixbuf2 (all versions)`\n- `gdk-pixbuf2 (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nTo mitigate this vulnerability, if the application does not require support for ICO files, disable the gdk-pixbuf ICO loader to prevent the vulnerable module from being executed.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[]}