Source: gdk-pixbuf Version: 2.44.7+dfsg-1 Severity: important Tags: security upstream Forwarded: https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/merge_requests/278 X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerability was published for gdk-ppixbuf. CVE-2026-81893[0]: | A flaw was found in gdk-pixbuf. When loading a specially crafted | JPEG image containing chunked ICC profile markers, an error during | ICC profile parsing can leave stale size metadata after the profile | buffer is freed. A subsequent allocation in the same decode can | cause an out-of-bounds write, potentially crashing the application. | To exploit this flaw, an application using gdk-pixbuf must process | the malicious JPEG image. Affected version >= 2.26.4 If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-81893 https://www.cve.org/CVERecord?id=CVE-2026-81893 [1] https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/merge_requests/278 [2] https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/commit/efe658674bd103d1c9bf50809d5767a3f6dd5a01 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
