Hi,

The following vulnerability was published for gdk-ppixbuf.

CVE-2026-81893[0]:
| A flaw was found in gdk-pixbuf. When loading a specially crafted
| JPEG image containing chunked ICC profile markers, an error during
| ICC profile parsing can leave stale size metadata after the profile
| buffer is freed. A subsequent allocation in the same decode can
| cause an out-of-bounds write, potentially crashing the application.
| To exploit this flaw, an application using gdk-pixbuf must process
| the malicious JPEG image.  Affected version >= 2.26.4


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-81893
https://www.cve.org/CVERecord?id=CVE-2026-81893
[1] https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/merge_requests/278
[2] https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/commit/efe658674bd103d1c9bf50809d5767a3f6dd5a01

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore