Bug#1143155: gdk-pixbuf: CVE-2026-16768

[Salvatore Bonaccorso]

Source: gdk-pixbuf
Version: 2.44.7+dfsg-1
Severity: important
Tags: security upstream
Forwarded: https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/302
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerability was published for gdk-pixbuf.

Filling for initial tracking of the upstream issue.

CVE-2026-16768[0]:
| A flaw was found in gdk-pixbuf. When parsing a specially crafted ICO
| file with pixel values that exceed the defined palette range, an
| out-of-bounds read can occur due to improper bounds checking against
| the actual palette size. This vulnerability causes heap bytes to be
| interpreted as valid palette indices and rendered as RGB pixel
| values in the output image, allowing an attacker to extract heap
| content via the generated output, such as a thumbnail.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-16768
    https://www.cve.org/CVERecord?id=CVE-2026-16768
[1] https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/302

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore