Out-of-Bounds Write Vulnerability in gdk-pixbuf Affects JPEG Image Processing
CVE-2026-81893

4.7MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Vendor
CVE Published:
27 August 2026

What is CVE-2026-81893?

A flaw in gdk-pixbuf allows processing of crafted JPEG images to result in mishandled ICC profile markers. This flaw can lead to an out-of-bounds write due to leftover size metadata after freeing the profile buffer, potentially crashing the application when attempting to allocate memory in the same decode context. Exploitation requires the application to process a malicious JPEG image.

References

https://access.redhat.com/security/cve/CVE-2026-81893
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2524834
issue-trackingx_refsource_REDHAT
https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/commit/efe658...

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Emmanuele Bassi for reporting this issue.
.