CVEvulnerability

CVE-2026-16768

5.3 MEDIUM Published 2026-07-23 Modified 2026-07-31 Official page ↗
Status
Awaiting Analysis
Published
2026-07-23
Last modified
2026-07-31
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-125

Description

A flaw was found in gdk-pixbuf. When parsing a specially crafted ICO file with pixel values that exceed the defined palette range, an out-of-bounds read can occur due to improper bounds checking against the actual palette size. This vulnerability causes heap bytes to be interpreted as valid palette indices and rendered as RGB pixel values in the output image, allowing an attacker to extract heap content via the generated output, such as a thumbnail.

Related

Weakness · CWE (1)

  • CWE-125 Out-of-bounds Read weakness

References