Control: retitle -1 gdk-pixbuf: CVE-2026-81893: OOB write when parsing crafted
JPEG image's ICC profile
On Fri, 28 Aug 2026 at 16:32:37 +0200, Salvatore Bonaccorso wrote:
| loading a specially crafted
| JPEG image containing chunked ICC profile markers [...]
| can cause an out-of-bounds write
In testing/unstable, I believe this only affects -ports architectures:
gdk-pixbuf >= 2.44.5+dfsg-3 loads most image formats using glycin rather than
its own C code. (Exceptions: .xpm, .xbm still use C code because the
equivalent Rust code in glycin was not feature-complete until recently.)
-ports architectures still use the C code and are still vulnerable
(glycin FTBFS on ppc64, and its build-deps are unavailable on the other
-ports architectures). A fix has been merged upstream but not yet
released, I expect it will be in 2.44.9. There is a new upstream
release 2.44.8 pending packaging, so we might as well add the fix for
this as a patch for the benefit of the -ports architectures.
trixie still uses the C code and so is still vulnerable, even on release
architectures.
smcv
