The vulnerability in gdk-pixbuf arises from improper bounds checking against the actual palette size when parsing ICO files. Specifically, pixel values that exceed the defined palette range cause an out-of-bounds read of heap memory. This memory is then interpreted as valid palette indices and rendered as RGB pixel values in the output image, such as thumbnails. This behavior can allow an attacker to extract heap content through the crafted image output. The CVSS 3.1 score is 5.3 (medium severity) with network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality impact.

An attacker can cause gdk-pixbuf to read beyond the intended palette bounds, exposing heap memory contents via the rendered image output. This leads to limited confidentiality impact by potentially leaking sensitive information from heap memory. There is no impact on integrity or availability reported.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-16768 for current remediation guidance. No official fix or workaround is currently documented. Users should monitor the vendor advisory for updates and apply patches once available.