Bug#1145988: gdk-pixbuf: CVE-2026-81893: OOB write when parsing crafted JPEG image's ICC profile

[Simon McVittie]

Control: retitle -1 gdk-pixbuf: CVE-2026-81893: OOB write when parsing crafted JPEG image's ICC profile

On Fri, 28 Aug 2026 at 16:32:37 +0200, Salvatore Bonaccorso wrote:
>| loading a specially crafted
>| JPEG image containing chunked ICC profile markers [...]
>| can cause an out-of-bounds write

In testing/unstable, I believe this only affects -ports architectures: 
gdk-pixbuf >= 2.44.5+dfsg-3 loads most image formats using glycin rather than 
its own C code. (Exceptions: .xpm, .xbm still use C code because the 
equivalent Rust code in glycin was not feature-complete until recently.)

-ports architectures still use the C code and are still vulnerable 
(glycin FTBFS on ppc64, and its build-deps are unavailable on the other 
-ports architectures). A fix has been merged upstream but not yet 
released, I expect it will be in 2.44.9. There is a new upstream 
release 2.44.8 pending packaging, so we might as well add the fix for 
this as a patch for the benefit of the -ports architectures.

trixie still uses the C code and so is still vulnerable, even on release 
architectures.

     smcv