Hi Simon, On Sun, Sep 13, 2026 at 01:59:25PM +0100, Simon McVittie wrote: > Control: retitle -1 gdk-pixbuf: CVE-2026-81893: OOB write when parsing > crafted JPEG image's ICC profile > > On Fri, 28 Aug 2026 at 16:32:37 +0200, Salvatore Bonaccorso wrote: > > | loading a specially crafted > > | JPEG image containing chunked ICC profile markers [...] > > | can cause an out-of-bounds write > > In testing/unstable, I believe this only affects -ports architectures: > gdk-pixbuf >= 2.44.5+dfsg-3 loads most image formats using glycin rather > than its own C code. (Exceptions: .xpm, .xbm still use C code because the > equivalent Rust code in glycin was not feature-complete until recently.) > > -ports architectures still use the C code and are still vulnerable (glycin > FTBFS on ppc64, and its build-deps are unavailable on the other -ports > architectures). A fix has been merged upstream but not yet released, I > expect it will be in 2.44.9. There is a new upstream release 2.44.8 pending > packaging, so we might as well add the fix for this as a patch for the > benefit of the -ports architectures. > > trixie still uses the C code and so is still vulnerable, even on release > architectures.
Thanks for the update. So at least at source-level it would still be affected, will keep the tracking as it is for now (unless someone objects). We have for now no clean way to state it becomes a 'nonissue' with only one suite. I have added though a note to clarify the status. Regards, Salvatore
