CVE-2026-16768Medium· 5.3▾ TwilightPoC availableA flaw was found in gdk-pixbuf. When parsing a specially crafted ICO file with pixel values that exceed the defined palette range, an out-of-bounds read can occur due to improper bounds checking against the actual palette size. This vuln…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 29.2 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.4%
A flaw was found in gdk-pixbuf. When parsing a specially crafted ICO file with pixel values that exceed the defined palette range, an out-of-bounds read can occur due to improper bounds checking against the actual palette size. This vulnerability causes heap bytes to be interpreted as valid palette indices and rendered as RGB pixel values in the output image, allowing an attacker to extract heap content via the generated output, such as a thumbnail.
gdk-pixbuf (all versions)gdk-pixbuf2 (all versions)gdk-pixbuf2 (all versions)gdk-pixbuf2 (all versions)gdk-pixbuf2 (all versions)gdk-pixbuf2 (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
To mitigate this vulnerability, if the application does not require support for ICO files, disable the gdk-pixbuf ICO loader to prevent the vulnerable module from being executed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-80101Medium· 4.4Gimp: multiple heap out-of-bounds reads in xwd loader from unrelated width and bytes-per-line validation
CVE-2026-82328Medium· 6.1Gimp: heap out-of-bounds read in ico loader via unvalidated used_clrs palette count
CVE-2026-82330Medium· 6.1Gimp: heap out-of-bounds read in pvr vq (compressed) decoder due to missing bounds check
CVE-2026-66759High· 7.1Gimp: out-of-bounds read in file-icns plugin causes information disclosure or crash on crafted icns images
CVE-2026-58011Medium· 6.5A flaw was found in GLib
CVE-2025-7345High· 7.5A flaw exists in gdk‑pixbuf within the gdk_pixbuf__jpeg_image_load_increment function (io-jpeg.c) and in glib’s g_base64_encode_step (glib/gbase64.c)