Gdk-pixbuf: gdk-pixbuf: invalid write in jpeg icc profile parser on error recovery

CVE-2026-81893 is an out-of-bounds write vulnerability (CWE-787) in gdk-pixbuf's JPEG ICC profile parser triggered during error recovery when handling chunked ICC profile markers in specially crafted JPEG images. The flaw occurs because stale size metadata remains after the ICC profile buffer is freed, allowing a subsequent allocation to write out-of-bounds, potentially crashing the application. Exploitation requires processing a malicious JPEG image with an application linked against a vulnerable gdk-pixbuf version (>= 2.26.4). Red Hat rates this issue as Moderate impact and notes a fix is available upstream in the gdk-pixbuf master branch, with downstream releases pending.

The vulnerability can cause out-of-bounds memory writes leading to application crashes (denial of service). There is no indication of confidentiality or integrity impact. No known exploits are reported in the wild. The flaw requires local processing of a malicious JPEG image by an application using the vulnerable library.

A fix is available upstream in the gdk-pixbuf master branch; downstream releases containing the fix are pending. Until patched, users should avoid opening or automatically indexing untrusted JPEG images with applications linked against vulnerable gdk-pixbuf versions (>= 2.26.4). Monitor vendor advisories for updated packages and apply them once released.