CVE-2026-18090: Out-of-bounds Read in Red Hat Red Hat Enterprise Linux 10

The vulnerability exists in the uncompress() function of gdk-pixbuf, which processes RLE-encoded ICNS icon data. It fails to validate the source buffer boundaries during decompression, resulting in a heap out-of-bounds read. This flaw can be triggered by a local attacker supplying a crafted ICNS file, potentially causing a denial of service via application crash or limited disclosure of memory contents. The issue requires user interaction to open or process the malicious file. Red Hat classifies this as a low impact flaw due to the local attack vector and required user interaction.

An attacker with local access can cause a denial of service by crashing the application processing the ICNS file or gain limited information disclosure from adjacent memory. The confidentiality impact is low, with no integrity impact, but availability impact is high due to potential crashes. The flaw may also aid in bypassing protection mechanisms by leaking memory addresses. Exploitation requires user interaction and local access, limiting the attack scope.

Red Hat advises not to open untrusted ICNS files from unknown sources. If ICNS image format support is not required, it should be disabled. No official patch or fix status is provided in the advisory, so patch status is not yet confirmed — check the Red Hat advisory for updates. These mitigations reduce exposure until a fix is available.