Description

A flaw was found in gdk-pixbuf. When loading a specially crafted JPEG image containing chunked ICC profile markers, an error during ICC profile parsing can leave stale size metadata after the profile buffer is freed. A subsequent allocation in the same decode can cause an out-of-bounds write, potentially crashing the application. To exploit this flaw, an application using gdk-pixbuf must process the malicious JPEG image. Affected version >= 2.26.4

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-08-27T20:18:57.043Z",
  "pubdate": "2026-08-27T20:18:57.043Z",
  "executiveSummary": "A critical memory corruption vulnerability exists in gdk-pixbuf, specifically within the JPEG image loader module. The flaw is categorized as an out-of-bounds write resulting from improper memory management during the processing of ICC (International Color Consortium) profile markers.\nThe vulnerability allows an attacker to trigger an out-of-bounds memory access by providing a specially crafted JPEG file containing malformed chunked ICC profile data. Successful exploitation requires an application utilizing the gdk-pixbuf library to load the malicious image file.\nThe impact of this vulnerability is significant, potentially leading to application crashes, denial-of-service, or the execution of arbitrary code within the context of the process handling the image. The flaw affects all gdk-pixbuf versions from 2.26.4 onwards.\nThere are no specific authentication or privilege requirements to trigger the vulnerability, as it is activated during the image decoding process. The risk is heightened in environments where end-users may upload or view arbitrary images, such as web browsers, document viewers, or image processing services.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of memory buffers during the parsing of ICC profile chunks embedded within JPEG image headers. When gdk-pixbuf parses a JPEG, it reconstructs ICC profile data from multiple segments. If a specific error condition is triggered during the parsing phase—specifically involving malformed chunked markers—the buffer allocated to hold the ICC profile data is deallocated, yet the metadata associated with the profile's size is not properly cleared or reset.\nThis creates a state of stale metadata where the library retains an incorrect length value for a buffer that no longer exists or has been reallocated for different purposes within the same decoding loop. Subsequent operations in the decoding sequence, which rely on this stale size information, trigger an out-of-bounds write operation.\nThe exploitation flow proceeds as follows: First, the attacker crafts a malicious JPEG image incorporating fragmented ICC profile markers designed to induce an error during the assembly phase. Upon loading the image, the gdk-pixbuf loader initiates the ICC profile reconstruction. As the loader enters the error-handling path for the malformed markers, it performs a premature 'free' on the profile buffer while failing to nullify the length tracking variables. Following this, the allocator may reuse the memory block or the application continues with an invalid offset calculation based on the stale size metadata.\nWhen the decoder proceeds to write subsequent decoded pixel data or metadata to the heap memory, it uses the stale length value as the offset boundary. Because this length no longer reflects the actual state of the allocated heap chunk, the write operation spills outside the intended buffer boundaries. This out-of-bounds write can overwrite adjacent memory structures, such as function pointers or object headers, depending on the heap layout at the time of execution. This corruption leads to a controlled or semi-controlled memory write, which can be leveraged to divert the execution flow of the host application, resulting in a crash or potential code execution.\nThe vulnerability is inherent to the logic within the gdk-pixbuf JPEG loader. It does not require network access, as the trigger is the local processing of the malicious file. Any application leveraging the vulnerable version of gdk-pixbuf as a dependency for image decoding is susceptible to this attack vector."
}