The vulnerability in gdk-pixbuf arises from the uncompress() function failing to validate source buffer boundaries during decompression of RLE-encoded ICNS icon data. This leads to a heap out-of-bounds read when processing a maliciously crafted ICNS file. The flaw can cause denial of service by crashing the application or limited information disclosure by reading adjacent memory. Exploitation requires local user interaction to open the malicious file. Red Hat classifies this as a low impact flaw due to the local attack vector and user interaction requirement. The CVSS v3.1 base score is 6.1 (medium severity) with attack vector local, low complexity, no privileges required, user interaction required, unchanged scope, low confidentiality impact, no integrity impact, and high availability impact. No official fix or patch is currently confirmed in the vendor advisory. Mitigations recommended by Red Hat include not opening untrusted ICNS files and disabling ICNS format support if unnecessary.

An attacker with local access who can trick a user into opening a specially crafted ICNS file may cause the application to crash, resulting in denial of service. Additionally, the attacker may gain limited information disclosure from adjacent memory, potentially revealing sensitive data. The vulnerability does not allow privilege escalation or integrity compromise but can impact availability and confidentiality to a limited extent.

Red Hat advises not to open untrusted ICNS files from unknown sources. If ICNS image format support is not required, it should be disabled. There is no confirmed official patch or fix available yet; users should monitor the Red Hat advisory for updates. Since exploitation requires user interaction, user education to avoid opening suspicious ICNS files is also recommended.