Hi,

The following vulnerability was published for gdk-pixbuf.

Filling for initial tracking of the upstream issue.

CVE-2026-16768[0]:
| A flaw was found in gdk-pixbuf. When parsing a specially crafted ICO
| file with pixel values that exceed the defined palette range, an
| out-of-bounds read can occur due to improper bounds checking against
| the actual palette size. This vulnerability causes heap bytes to be
| interpreted as valid palette indices and rendered as RGB pixel
| values in the output image, allowing an attacker to extract heap
| content via the generated output, such as a thumbnail.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-16768
https://www.cve.org/CVERecord?id=CVE-2026-16768
[1] https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/302

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Control: retitle -1 gdk-pixbuf: CVE-2026-16768: out-of-bounds read when loading malicious .ico palette
Control: forwarded -1 https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/merge_requests/279
gdk-pixbuf >= 2.44.5+dfsg-3 loads most image formats using glycin rather than
its own C code. (Exceptions: .xpm, .xbm still use C code because the
equivalent Rust code in glycin was not feature-complete until recently.)

Hi Simon,

Thanks for the update. So at least at source-level it would still be
affected, will keep the tracking as it is for now (unless someone
objects). We have for now no clean way to state it becomes a
'nonissue' with only one suite. I have added though a note to clarify
the status.

Regards,
Salvatore