What’s Vulnerable › Vulnerabilities

CVE-2026-16768: Gdk-pixbuf: out-of-bounds read in ico parser

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-23 · updated 2026-07-31
• Weakness: CWE-125

Description

A flaw was found in gdk-pixbuf. When parsing a specially crafted ICO file with pixel values that exceed the defined palette range, an out-of-bounds read can occur due to improper bounds checking against the actual palette size. This vulnerability causes heap bytes to be interpreted as valid palette indices and rendered as RGB pixel values in the output image, allowing an attacker to extract heap content via the generated output, such as a thumbnail.

Affected products

• GNOME Gdk-Pixbuf: all versions
• Red Hat Enterprise Linux 10: all versions
• Red Hat Enterprise Linux 6: all versions
• Red Hat Enterprise Linux 7: all versions
• Red Hat Enterprise Linux 8: all versions
• Red Hat Enterprise Linux 9: all versions

References

• https://access.redhat.com/security/cve/CVE-2026-16768
• https://bugzilla.redhat.com/show_bug.cgi?id=2506437
• https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/302
• https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/302

Get alerted when CVE-2026-16768 or the next vulnerability affects your stack