gdk-pixbuf CVE-2026-18090

Exploitation requires that gdk-pixbuf process a specially crafted .icns file. This occurs when a user opens or previews such a file in any GTK/GNOME application that uses gdk-pixbuf for image loading (e.g., GNOME Files/Nautilus, Eye of GNOME, GIMP, Shotwell, or any GTK application that renders icon images). The CVSS AV:L/UI:R vector confirms the attack is local and requires user interaction - the file must reach the user's filesystem and trigger image loading. A meaningful reduction in the user-interaction barrier occurs if the application automatically generates thumbnails for directory contents without the user explicitly opening the file. Exploitation is limited to contexts where .icns file processing is enabled in the gdk-pixbuf loader configuration; server environments that do not render desktop icons are not exposed.

The provided CVSS 6.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H) correctly places this as a file-triggered, user-interaction-dependent vulnerability rather than a network-reachable flaw. The high availability impact (A:H) is credible - an out-of-bounds read in a decompressor frequently causes reliable application crashes - while the low confidentiality impact (C:L) reflects the theoretical but difficult-to-control nature of heap disclosure via this class of bug. No EPSS score, KEV listing, or public proof-of-concept code is present in the provided intelligence, consistent with a moderate-severity library flaw that has not yet attracted active exploitation tooling. The primary practical risk is denial of service against desktop applications using gdk-pixbuf; targeted information disclosure would require an attacker to recover and interpret heap contents from crash telemetry or a controlled side-channel, significantly raising attack complexity beyond what AC:L alone implies. The realistic threat model is drive-by file attacks (malicious email attachments, crafted icon downloads) against desktop Linux users, rather than server-side exploitation.

An attacker crafts a malicious .icns file in which the RLE-compressed stream encodes lengths that exceed the decompression source buffer's actual size. The file is delivered to a Linux desktop user via email attachment or malicious download. When the user opens a file manager that auto-generates thumbnails (such as Nautilus), gdk-pixbuf's uncompress() function processes the file automatically, reads past the allocated buffer, and crashes the file manager - or, in a more targeted variant, the attacker recovers heap data from crash dumps to infer memory layout for a follow-on exploit. No public proof-of-concept is available at time of analysis.