PT-2026-64024 · Red Hat · Red Hat Enterprise Linux 10+4

CVE-2026-16768 · Published 2026-07-23 · Updated 2026-07-23

NVD

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

A flaw was found in gdk-pixbuf. When parsing a specially crafted ICO file with pixel values that exceed the defined palette range, an out-of-bounds read can occur due to improper bounds checking against the actual palette size. This vulnerability causes heap bytes to be interpreted as valid palette indices and rendered as RGB pixel values in the output image, allowing an attacker to extract heap content via the generated output, such as a thumbnail.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-16768

Affected Products

Red Hat Enterprise Linux 10

Red Hat Enterprise Linux 6

Red Hat Enterprise Linux 7

Red Hat Enterprise Linux 8

Red Hat Enterprise Linux 9

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-16768 · Security Note
• https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/302 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2506437 · Note
• https://access.redhat.com/security/cve/CVE-2026-16768 · Note