Bug#1145988: gdk-pixbuf: CVE-2026-81893: OOB write when parsing crafted JPEG image's ICC profile

[Salvatore Bonaccorso]

Hi Simon,

On Sun, Sep 13, 2026 at 01:59:25PM +0100, Simon McVittie wrote:
> Control: retitle -1 gdk-pixbuf: CVE-2026-81893: OOB write when parsing crafted JPEG image's ICC profile
> 
> On Fri, 28 Aug 2026 at 16:32:37 +0200, Salvatore Bonaccorso wrote:
> > | loading a specially crafted
> > | JPEG image containing chunked ICC profile markers [...]
> > | can cause an out-of-bounds write
> 
> In testing/unstable, I believe this only affects -ports architectures:
> gdk-pixbuf >= 2.44.5+dfsg-3 loads most image formats using glycin rather
> than its own C code. (Exceptions: .xpm, .xbm still use C code because the
> equivalent Rust code in glycin was not feature-complete until recently.)
> 
> -ports architectures still use the C code and are still vulnerable (glycin
> FTBFS on ppc64, and its build-deps are unavailable on the other -ports
> architectures). A fix has been merged upstream but not yet released, I
> expect it will be in 2.44.9. There is a new upstream release 2.44.8 pending
> packaging, so we might as well add the fix for this as a patch for the
> benefit of the -ports architectures.
> 
> trixie still uses the C code and so is still vulnerable, even on release
> architectures.

Thanks for the update. So at least at source-level it would still be
affected, will keep the tracking as it is for now (unless someone
objects). We have for now no clean way to state it becomes a
'nonissue' with only one suite. I have added though a note to clarify
the status.

Regards,
Salvatore