CVE-2026-81893 Gdk-pixbuf: gdk-pixbuf: invalid write in jpeg icc profile parser on error recovery
An attacker can cause a denial of service by tricking an application into processing a malicious JPEG image with crafted ICC profile markers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-81893?
CVE-2026-81893 is a medium-severity memory corruption vulnerability in Red Hat Enterprise Linux 10, published on 27 Aug 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A flaw was found in gdk-pixbuf. When loading a specially crafted JPEG image containing chunked ICC profile markers, an error during ICC profile parsing can leave stale size metadata after the profile buffer is freed. A subsequent allocation in the same decode can cause an out-of-bounds write, potentially crashing the application. To exploit this flaw, an application using gdk-pixbuf must process the malicious JPEG image.
Affected version >= 2.26.4
Weakness: CWE-787
Which versions are affected by CVE-2026-81893?
How do I fix CVE-2026-81893?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-81893 being exploited?
There is no known exploitation of CVE-2026-81893 in the wild and no public exploit code.
Sources
Also known as AZL-98370, BELL-CVE-2026-81893, DEBIAN-CVE-2026-81893, ECHO-b76b-475e-7ef9, GHSA-237w-6c39-25rh, OESA-2026-3773 and 1 more.