Vulnerability-Lookup

CVE-2026-16768 (GCVE-0-2026-16768)

Vulnerability from cvelistv5 – Published: 2026-07-23 16:41 – Updated: 2026-07-24 15:12

Title

Gdk-pixbuf: out-of-bounds read in ico parser

Summary

A flaw was found in gdk-pixbuf. When parsing a specially crafted ICO file with pixel values that exceed the defined palette range, an out-of-bounds read can occur due to improper bounds checking against the actual palette size. This vulnerability causes heap bytes to be interpreted as valid palette indices and rendered as RGB pixel values in the output image, allowing an attacker to extract heap content via the generated output, such as a thumbnail.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-125 - Out-of-bounds Read

Assigner

redhat

References

3 references

URL	Tags
https://access.redhat.com/security/cve/CVE-2026-16768	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2506437	issue-trackingx_refsource_REDHAT
https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/302

Impacted products

6 products

Vendor	Product	Version
GNOME	gdk-pixbuf	Affected: 0 , < * (semver)
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9

Date Public

2026-06-08 00:00

Credits

Red Hat would like to thank Matej Smycka for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-16768",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-23T17:49:43.531984Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-23T17:49:54.070Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/302"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://gitlab.gnome.org/GNOME/gdk-pixbuf",
          "defaultStatus": "unaffected",
          "packageName": "gdk-pixbuf",
          "product": "gdk-pixbuf",
          "vendor": "GNOME",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "gdk-pixbuf2",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "affected",
          "packageName": "gdk-pixbuf2",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "affected",
          "packageName": "gdk-pixbuf2",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "gdk-pixbuf2",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "gdk-pixbuf2",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Matej Smycka for reporting this issue."
        }
      ],
      "datePublic": "2026-06-08T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in gdk-pixbuf. When parsing a specially crafted ICO file with pixel values that exceed the defined palette range, an out-of-bounds read can occur due to improper bounds checking against the actual palette size. This vulnerability causes heap bytes to be interpreted as valid palette indices and rendered as RGB pixel values in the output image, allowing an attacker to extract heap content via the generated output, such as a thumbnail."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-24T15:12:41.208Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-16768"
        },
        {
          "name": "RHBZ#2506437",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506437"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/302"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-06-08T00:00:00.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-06-08T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Gdk-pixbuf: out-of-bounds read in ico parser",
      "workarounds": [
        {
          "lang": "en",
          "value": "To mitigate this vulnerability, if the application does not require support for ICO files, disable the gdk-pixbuf ICO loader to prevent the vulnerable module from being executed."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-125: Out-of-bounds Read"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-16768",
    "datePublished": "2026-07-23T16:41:20.704Z",
    "dateReserved": "2026-07-23T14:25:29.368Z",
    "dateUpdated": "2026-07-24T15:12:41.208Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-16768",
      "date": "2026-07-24",
      "epss": "0.00236",
      "percentile": "0.14709"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-16768\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2026-07-23T17:16:28.037\",\"lastModified\":\"2026-07-24T16:16:33.737\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A flaw was found in gdk-pixbuf. When parsing a specially crafted ICO file with pixel values that exceed the defined palette range, an out-of-bounds read can occur due to improper bounds checking against the actual palette size. This vulnerability causes heap bytes to be interpreted as valid palette indices and rendered as RGB pixel values in the output image, allowing an attacker to extract heap content via the generated output, such as a thumbnail.\"}],\"affected\":[{\"source\":\"secalert@redhat.com\",\"affectedData\":[{\"vendor\":\"GNOME\",\"product\":\"gdk-pixbuf\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://gitlab.gnome.org/GNOME/gdk-pixbuf\",\"packageName\":\"gdk-pixbuf\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"*\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"gdk-pixbuf2\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"gdk-pixbuf2\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"gdk-pixbuf2\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"gdk-pixbuf2\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"gdk-pixbuf2\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-07-23T17:49:43.531984Z\",\"id\":\"CVE-2026-16768\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"references\":[{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-16768\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2506437\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/302\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/302\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-24T15:12:33+00:00",
      "cve": "CVE-2026-16768",
      "id": "CVE-2026-16768",
      "initial_release_date": "2026-06-08T00:00:00+00:00",
      "product_status:known_affected": "21",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "gdk-pixbuf: out-of-bounds read in ICO parser",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-16768.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-16768\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-23T17:49:43.531984Z\"}}}], \"references\": [{\"url\": \"https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/302\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-23T17:49:25.941Z\"}}], \"cna\": {\"title\": \"Gdk-pixbuf: out-of-bounds read in ico parser\", \"credits\": [{\"lang\": \"en\", \"value\": \"Red Hat would like to thank Matej Smycka for reporting this issue.\"}], \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Moderate\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"GNOME\", \"product\": \"gdk-pixbuf\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"semver\"}], \"packageName\": \"gdk-pixbuf\", \"collectionURL\": \"https://gitlab.gnome.org/GNOME/gdk-pixbuf\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"packageName\": \"gdk-pixbuf2\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 6\", \"packageName\": \"gdk-pixbuf2\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 7\", \"packageName\": \"gdk-pixbuf2\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"packageName\": \"gdk-pixbuf2\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"gdk-pixbuf2\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-06-08T00:00:00.000Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-06-08T00:00:00.000Z\", \"value\": \"Made public.\"}], \"datePublic\": \"2026-06-08T00:00:00.000Z\", \"references\": [{\"url\": \"https://access.redhat.com/security/cve/CVE-2026-16768\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2506437\", \"name\": \"RHBZ#2506437\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/302\"}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"To mitigate this vulnerability, if the application does not require support for ICO files, disable the gdk-pixbuf ICO loader to prevent the vulnerable module from being executed.\"}], \"x_generator\": {\"engine\": \"cvelib 1.8.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw was found in gdk-pixbuf. When parsing a specially crafted ICO file with pixel values that exceed the defined palette range, an out-of-bounds read can occur due to improper bounds checking against the actual palette size. This vulnerability causes heap bytes to be interpreted as valid palette indices and rendered as RGB pixel values in the output image, allowing an attacker to extract heap content via the generated output, such as a thumbnail.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-125\", \"description\": \"Out-of-bounds Read\"}]}], \"providerMetadata\": {\"orgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"shortName\": \"redhat\", \"dateUpdated\": \"2026-07-24T15:12:41.208Z\"}, \"x_redhatCweChain\": \"CWE-125: Out-of-bounds Read\"}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-16768\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-24T15:12:41.208Z\", \"dateReserved\": \"2026-07-23T14:25:29.368Z\", \"assignerOrgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"datePublished\": \"2026-07-23T16:41:20.704Z\", \"assignerShortName\": \"redhat\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-744W-9FJJ-P376

Vulnerability from github – Published: 2026-07-23 18:31 – Updated: 2026-07-23 18:31

Details

Severity

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-16768"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-23T17:16:28Z",
    "severity": "MODERATE"
  },
  "details": "A flaw was found in gdk-pixbuf. When parsing a specially crafted ICO file with pixel values that exceed the defined palette range, an out-of-bounds read can occur due to improper bounds checking against the actual palette size. This vulnerability causes heap bytes to be interpreted as valid palette indices and rendered as RGB pixel values in the output image, allowing an attacker to extract heap content via the generated output, such as a thumbnail.",
  "id": "GHSA-744w-9fjj-p376",
  "modified": "2026-07-23T18:31:45Z",
  "published": "2026-07-23T18:31:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16768"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16768"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506437"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/302"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

ubuntu-cve-2026-16768

Vulnerability from osv_ubuntu

Published

2026-07-24 00:00

Modified

2026-07-24 00:00

Summary

Details

(A flaw was found in gdk-pixbuf. When parsing a specially crafted ICO f ...)

Severity

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-16768	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-16768	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "gir1.2-gdkpixbuf-2.0",
            "binary_version": "2.32.2-1ubuntu1.6+esm3"
          },
          {
            "binary_name": "libgdk-pixbuf2.0-0",
            "binary_version": "2.32.2-1ubuntu1.6+esm3"
          },
          {
            "binary_name": "libgdk-pixbuf2.0-common",
            "binary_version": "2.32.2-1ubuntu1.6+esm3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "gdk-pixbuf",
        "purl": "pkg:deb/ubuntu/gdk-pixbuf@2.32.2-1ubuntu1.6+esm3?arch=source\u0026distro=esm-infra-legacy/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.32.1-1",
        "2.32.2-1",
        "2.32.2-1ubuntu1",
        "2.32.2-1ubuntu1.2",
        "2.32.2-1ubuntu1.3",
        "2.32.2-1ubuntu1.4",
        "2.32.2-1ubuntu1.5",
        "2.32.2-1ubuntu1.6",
        "2.32.2-1ubuntu1.6+esm1",
        "2.32.2-1ubuntu1.6+esm2",
        "2.32.2-1ubuntu1.6+esm3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "gir1.2-gdkpixbuf-2.0",
            "binary_version": "2.36.11-2ubuntu0.1~esm3"
          },
          {
            "binary_name": "libgdk-pixbuf2.0-0",
            "binary_version": "2.36.11-2ubuntu0.1~esm3"
          },
          {
            "binary_name": "libgdk-pixbuf2.0-bin",
            "binary_version": "2.36.11-2ubuntu0.1~esm3"
          },
          {
            "binary_name": "libgdk-pixbuf2.0-common",
            "binary_version": "2.36.11-2ubuntu0.1~esm3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "gdk-pixbuf",
        "purl": "pkg:deb/ubuntu/gdk-pixbuf@2.36.11-2ubuntu0.1~esm3?arch=source\u0026distro=esm-infra/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.36.11-1",
        "2.36.11-1ubuntu0.1",
        "2.36.11-2",
        "2.36.11-2ubuntu0.1~esm1",
        "2.36.11-2ubuntu0.1~esm2",
        "2.36.11-2ubuntu0.1~esm3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "gir1.2-gdkpixbuf-2.0",
            "binary_version": "2.40.0+dfsg-3ubuntu0.5+esm3"
          },
          {
            "binary_name": "libgdk-pixbuf2.0-0",
            "binary_version": "2.40.0+dfsg-3ubuntu0.5+esm3"
          },
          {
            "binary_name": "libgdk-pixbuf2.0-bin",
            "binary_version": "2.40.0+dfsg-3ubuntu0.5+esm3"
          },
          {
            "binary_name": "libgdk-pixbuf2.0-common",
            "binary_version": "2.40.0+dfsg-3ubuntu0.5+esm3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "gdk-pixbuf",
        "purl": "pkg:deb/ubuntu/gdk-pixbuf@2.40.0+dfsg-3ubuntu0.5+esm3?arch=source\u0026distro=esm-infra/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.40.0+dfsg-1build1",
        "2.40.0+dfsg-1ubuntu1",
        "2.40.0+dfsg-2",
        "2.40.0+dfsg-3",
        "2.40.0+dfsg-3ubuntu0.1",
        "2.40.0+dfsg-3ubuntu0.2",
        "2.40.0+dfsg-3ubuntu0.3",
        "2.40.0+dfsg-3ubuntu0.4",
        "2.40.0+dfsg-3ubuntu0.5",
        "2.40.0+dfsg-3ubuntu0.5+esm1",
        "2.40.0+dfsg-3ubuntu0.5+esm3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "gdk-pixbuf-tests",
            "binary_version": "2.42.8+dfsg-1ubuntu0.5"
          },
          {
            "binary_name": "gir1.2-gdkpixbuf-2.0",
            "binary_version": "2.42.8+dfsg-1ubuntu0.5"
          },
          {
            "binary_name": "libgdk-pixbuf-2.0-0",
            "binary_version": "2.42.8+dfsg-1ubuntu0.5"
          },
          {
            "binary_name": "libgdk-pixbuf2.0-bin",
            "binary_version": "2.42.8+dfsg-1ubuntu0.5"
          },
          {
            "binary_name": "libgdk-pixbuf2.0-common",
            "binary_version": "2.42.8+dfsg-1ubuntu0.5"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "gdk-pixbuf",
        "purl": "pkg:deb/ubuntu/gdk-pixbuf@2.42.8+dfsg-1ubuntu0.5?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.42.6+dfsg-1build2",
        "2.42.6+dfsg-1build3",
        "2.42.6+dfsg-2ubuntu2",
        "2.42.6+dfsg-2ubuntu3",
        "2.42.8+dfsg-1",
        "2.42.8+dfsg-1ubuntu0.1",
        "2.42.8+dfsg-1ubuntu0.2",
        "2.42.8+dfsg-1ubuntu0.3",
        "2.42.8+dfsg-1ubuntu0.4",
        "2.42.8+dfsg-1ubuntu0.5"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "gdk-pixbuf-tests",
            "binary_version": "2.42.10+dfsg-3ubuntu3.3"
          },
          {
            "binary_name": "gir1.2-gdkpixbuf-2.0",
            "binary_version": "2.42.10+dfsg-3ubuntu3.3"
          },
          {
            "binary_name": "libgdk-pixbuf-2.0-0",
            "binary_version": "2.42.10+dfsg-3ubuntu3.3"
          },
          {
            "binary_name": "libgdk-pixbuf2.0-bin",
            "binary_version": "2.42.10+dfsg-3ubuntu3.3"
          },
          {
            "binary_name": "libgdk-pixbuf2.0-common",
            "binary_version": "2.42.10+dfsg-3ubuntu3.3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "gdk-pixbuf",
        "purl": "pkg:deb/ubuntu/gdk-pixbuf@2.42.10+dfsg-3ubuntu3.3?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.42.10+dfsg-1build1",
        "2.42.10+dfsg-3",
        "2.42.10+dfsg-3ubuntu1",
        "2.42.10+dfsg-3ubuntu2",
        "2.42.10+dfsg-3ubuntu3",
        "2.42.10+dfsg-3ubuntu3.1",
        "2.42.10+dfsg-3ubuntu3.2",
        "2.42.10+dfsg-3ubuntu3.3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "gdk-pixbuf-tests",
            "binary_version": "2.44.5+dfsg-4ubuntu1"
          },
          {
            "binary_name": "gir1.2-gdkpixbuf-2.0",
            "binary_version": "2.44.5+dfsg-4ubuntu1"
          },
          {
            "binary_name": "libgdk-pixbuf-2.0-0",
            "binary_version": "2.44.5+dfsg-4ubuntu1"
          },
          {
            "binary_name": "libgdk-pixbuf2.0-bin",
            "binary_version": "2.44.5+dfsg-4ubuntu1"
          },
          {
            "binary_name": "libgdk-pixbuf2.0-common",
            "binary_version": "2.44.5+dfsg-4ubuntu1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "gdk-pixbuf",
        "purl": "pkg:deb/ubuntu/gdk-pixbuf@2.44.5+dfsg-4ubuntu1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.42.12+dfsg-5",
        "2.44.4+dfsg-1",
        "2.44.5+dfsg-3",
        "2.44.5+dfsg-4",
        "2.44.5+dfsg-4ubuntu1"
      ]
    }
  ],
  "aliases": [],
  "details": "(A flaw was found in gdk-pixbuf. When parsing a specially crafted ICO f ...)",
  "id": "UBUNTU-CVE-2026-16768",
  "modified": "2026-07-24T00:00:00Z",
  "published": "2026-07-24T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-16768"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16768"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-16768"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-16768 (GCVE-0-2026-16768)

GHSA-744W-9FJJ-P376

ubuntu-cve-2026-16768

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature