Hi Simon, On Sun, Sep 13, 2026 at 01:54:49PM +0100, Simon McVittie wrote: > Control: retitle -1 gdk-pixbuf: CVE-2026-16768: out-of-bounds read when > loading malicious .ico palette > Control: forwarded -1 > https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/merge_requests/279 > > On Fri, 31 Jul 2026 at 07:19:27 +0200, Salvatore Bonaccorso wrote: > > | When parsing a specially crafted ICO > > | file with pixel values that exceed the defined palette range, an > > | out-of-bounds read can occur due to improper bounds checking against > > | the actual palette size. > > In testing/unstable, I believe this only affects -ports architectures: > gdk-pixbuf >= 2.44.5+dfsg-3 loads most image formats using glycin rather than > its own C code. (Exceptions: .xpm, .xbm still use C code because the > equivalent Rust code in glycin was not feature-complete until recently.) > > -ports architectures still use the C code and are still vulnerable (glycin > FTBFS on ppc64, and its build-deps are unavailable on the other -ports > architectures). > > trixie still uses the C code and so is still vulnerable. A fix was proposed > upstream in <https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/merge_requests/279> > but has not yet been reviewed/merged.
Thanks for the update. So at least at source-level it would still be affected, will keep the tracking as it is for now (unless someone objects). We have for now no clean way to state it becomes a 'nonissue' with only one suite. I have added though a note to clarify the status. Regards, Salvatore
