Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A flaw was found in gdk-pixbuf's JPEG loader (io-jpeg.c). When parsing chunked ICC profile data from JPEG APP2 markers, the error cleanup path in jpeg_parse_exif_app2_segment() frees the ICC profile buffer but previously failed to reset icc_profile_size and icc_profile_size_allocated. A specially crafted JPEG can trigger allocation, an error that frees the buffer while leaving stale size metadata, and a subsequent re-allocation that leads to an out-of-bounds write during ICC profile assembly.

The issue was introduced when error cleanup was added for chunked ICC profile handling in gdk-pixbuf 2.43.4/2.44.0 (commit 4af78023). It is fixed upstream in commit efe658674bd103d1c9bf50809d5767a3f6dd5a01 ("jpeg: When freeing memory, unset the size"), merged via https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/merge_requests/278 on 2026-08-24. No fixed upstream release tag exists yet.

Red Hat tracking: PSIRTSUPT-22558.