CVE-2026-81893
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
24/100
Published: 2026-08-27
Modified: 2026-11-06
First seen: 2026-11-06
Status: active
Attack Surface
No Auth
CVSS Vector Breakdown
AV:
Local
AC:
High
PR:
None
UI:
Required
S:
Unchanged
C:
None
I:
None
A:
High
Description
A flaw was found in gdk-pixbuf. When loading a specially crafted JPEG image containing chunked ICC profile markers, an error during ICC profile parsing can leave stale size metadata after the profile buffer is freed. A subsequent allocation in the same decode can cause an out-of-bounds write, potentially crashing the application. To exploit this flaw, an application using gdk-pixbuf must process the malicious JPEG image. Affected version >= 2.26.4