Bug#1143155: gdk-pixbuf: CVE-2026-16768: out-of-bounds read when loading malicious .ico palette

[Simon McVittie]

Control: retitle -1 gdk-pixbuf: CVE-2026-16768: out-of-bounds read when loading malicious .ico palette
Control: forwarded -1 https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/merge_requests/279

On Fri, 31 Jul 2026 at 07:19:27 +0200, Salvatore Bonaccorso wrote:
>| When parsing a specially crafted ICO
>| file with pixel values that exceed the defined palette range, an
>| out-of-bounds read can occur due to improper bounds checking against
>| the actual palette size.

In testing/unstable, I believe this only affects -ports architectures:
gdk-pixbuf >= 2.44.5+dfsg-3 loads most image formats using glycin rather than
its own C code. (Exceptions: .xpm, .xbm still use C code because the
equivalent Rust code in glycin was not feature-complete until recently.)

-ports architectures still use the C code and are still vulnerable 
(glycin FTBFS on ppc64, and its build-deps are unavailable on the other 
-ports architectures).

trixie still uses the C code and so is still vulnerable. A fix was 
proposed upstream in 
<https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/merge_requests/279> but has 
not yet been reviewed/merged.

     smcv