---
id: CVE-2026-16768
title: 'Gdk-pixbuf: out-of-bounds read in ico parser'
summary: >-
  A flaw was found in gdk-pixbuf. When parsing a specially crafted ICO file with
  pixel values that exceed the defined palette range, an out-of-bounds read can
  occur due to improper bounds checking against the actual palette size. This
  vuln…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-125
vendor: GNOME
product: gdk-pixbuf
affected:
  - gdk-pixbuf (all versions)
  - gdk-pixbuf2 (all versions)
  - gdk-pixbuf2 (all versions)
  - gdk-pixbuf2 (all versions)
  - gdk-pixbuf2 (all versions)
  - gdk-pixbuf2 (all versions)
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-07-23T17:49:43.531984Z'
exploitAvailable: true
published: '2026-07-23'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T19:24:21.288Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-16768'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-16768'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2506437'
    label: RHBZ#2506437
  - url: 'https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/302'
tags:
  - cve.org
  - exploit-available
epss: 0.00405
epssPercentile: 0.35046
ingestedAt: '2026-11-05T22:38:31.536Z'
---

## Overview

A flaw was found in gdk-pixbuf. When parsing a specially crafted ICO file with pixel values that exceed the defined palette range, an out-of-bounds read can occur due to improper bounds checking against the actual palette size. This vulnerability causes heap bytes to be interpreted as valid palette indices and rendered as RGB pixel values in the output image, allowing an attacker to extract heap content via the generated output, such as a thumbnail.

## Affected

- `gdk-pixbuf (all versions)`
- `gdk-pixbuf2 (all versions)`
- `gdk-pixbuf2 (all versions)`
- `gdk-pixbuf2 (all versions)`
- `gdk-pixbuf2 (all versions)`
- `gdk-pixbuf2 (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

To mitigate this vulnerability, if the application does not require support for ICO files, disable the gdk-pixbuf ICO loader to prevent the vulnerable module from being executed.