gdk-pixbuf CVE-2026-81893

Exploitation requires that a user or automated process opens a specially crafted JPEG file using an application that relies on gdk-pixbuf for image decoding - this is the non-negotiable trigger condition. The JPEG must contain chunked ICC profile markers (APP2 segments) crafted to provoke an error during profile parsing, which is a non-default file structure but a valid JPEG extension. High attack complexity (AC:H) reflects that specific heap memory layout conditions must hold at the time of the subsequent allocation for the out-of-bounds write to produce a crash rather than a silent no-op. No authentication or elevated privilege is required, but user interaction (UI:R) is mandatory - a user must actively open the file, or an automated pipeline must process it. Exploitation is limited to denial-of-service (application crash) only; no code execution or data exfiltration path is indicated by the CVSS vector or description.

The CVSS 3.1 base score of 4.7 (Medium) reflects a constrained threat profile: AV:L indicates the malicious JPEG must be accessible locally, AC:H signals that specific memory layout conditions must align for the write to land harmfully, UI:R requires a user to actively open the file, and the impact is limited entirely to Availability (A:H) with no confidentiality or integrity effect. No EPSS score was provided in source data; this omission should be noted. There is no CISA KEV listing and no known public proof-of-concept, placing exploitation probability in the lower range. The practical risk is concentrated in desktop environments and automated image-processing pipelines where untrusted JPEGs may be rendered by gdk-pixbuf consumers (Nautilus thumbnails, Eye of GNOME, LibreOffice, GIMP, etc.). For server-side batch processors, the risk is somewhat elevated because automation reduces the UI:R friction. Overall, this is a realistic moderate-priority issue - not a high-urgency emergency - but warrants patching given the breadth of RHEL coverage.

An attacker crafts a malicious JPEG file embedding specially structured chunked ICC profile markers that trigger the error path in gdk-pixbuf's ICC reassembly logic, then delivers the file to a target via email attachment, web download, or a shared network folder. When a victim on an affected RHEL system opens the file in any gdk-pixbuf-linked application - such as an image viewer, the Nautilus file manager generating a thumbnail, or a GTK-based application - the out-of-bounds write occurs, crashing the application. No public exploit code has been identified, but the upstream commit provides sufficient technical detail for a motivated researcher to reproduce the condition.