Gdk-pixbuf: gdk-pixbuf: heap out-of-bounds read in uncompress() via crafted icns rle block

The vulnerability in gdk-pixbuf (CVE-2026-18090) arises from improper validation of source buffer boundaries in the uncompress() function handling RLE-encoded ICNS icon data. A crafted ICNS file can trigger a heap out-of-bounds read, potentially causing a denial of service or leaking sensitive memory contents. The flaw requires local access and user interaction to open the malicious file. Red Hat classifies this as a low impact flaw due to these constraints. No official patch or fixed versions are explicitly stated in the advisory. Mitigation includes avoiding opening untrusted ICNS files and disabling ICNS support if not needed.

An attacker with local access who can trick a user into opening a malicious ICNS file may cause the application to crash or disclose limited sensitive information from adjacent memory. The confidentiality impact is low, integrity impact is none, and availability impact is high due to potential crashes. The flaw can also aid bypassing protection mechanisms by leaking memory addresses. There are no known exploits in the wild. The vulnerability requires user interaction and local access, limiting its overall impact.

No official patch or fix is currently confirmed. Users should avoid opening untrusted ICNS files from unknown sources. If ICNS image format support is not required, it is recommended to disable it to mitigate risk. Monitor vendor advisories for updates regarding patches or fixes.