Bug 2524834 (CVE-2026-81893) - CVE-2026-81893 gdk-pixbuf: gdk-pixbuf: invalid write in JPEG ICC profile parser on error recovery
Summary: CVE-2026-81893 gdk-pixbuf: gdk-pixbuf: invalid write in JPEG ICC profile pars...
Keywords:
Status: NEW
Alias: CVE-2026-81893
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2525141 2525142
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-08-27 06:08 UTC by OSIDB Bzimport
Modified: 2026-08-27 18:21 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-08-27 06:08:58 UTC 
A flaw was found in gdk-pixbuf's JPEG loader (io-jpeg.c). When parsing chunked ICC profile data from JPEG APP2 markers, the error cleanup path in jpeg_parse_exif_app2_segment() frees the ICC profile buffer but previously failed to reset icc_profile_size and icc_profile_size_allocated. A specially crafted JPEG can trigger allocation, an error that frees the buffer while leaving stale size metadata, and a subsequent re-allocation that leads to an out-of-bounds write during ICC profile assembly.

The issue was introduced when error cleanup was added for chunked ICC profile handling in gdk-pixbuf 2.43.4/2.44.0 (commit 4af78023). It is fixed upstream in commit efe658674bd103d1c9bf50809d5767a3f6dd5a01 ("jpeg: When freeing memory, unset the size"), merged via https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/merge_requests/278 on 2026-08-24. No fixed upstream release tag exists yet.

Red Hat tracking: PSIRTSUPT-22558.
Note You need to log in before you can comment on or make changes to this bug.