CVE-2026-18090

medium

Published 2026-09-08 · Modified 2026-09-08

Discuss on Community Propose mitigation

CVSS v3

6.1

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

CVSS v4 NEW

—

not yet in upstream

VIR risk

6.1

Description

A flaw was found in gdk-pixbuf. This vulnerability allows a remote attacker to cause a heap out-of-bounds read by providing a specially crafted Apple Icon Image (.icns) file. The uncompress() function, which handles RLE-encoded ICNS icon data, fails to validate the source buffer's boundaries during decompression. This can lead to a denial of service, where the application crashes, or to information disclosure, potentially revealing sensitive data from adjacent memory.

Predictions

Exploit likelihood

61%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

Mitigation details

Source: Debian Security Tracker · View original ↗ · DFSG

CVE-2026-18090 NameCVE-2026-18090 SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) Vulnerable and fixed packages The table below lists information on source packages. Source PackageReleaseVersionStatus gdk-pixbuf (PTS)bookworm, bookworm (security)2.42.10+dfsg-1+deb12u4vulnerable trixie…

CVE-2026-18090

Name	CVE-2026-18090
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
gdk-pixbuf (PTS)	bookworm, bookworm (security)	2.42.10+dfsg-1+deb12u4	vulnerable
	trixie (security), trixie	2.42.12+dfsg-4+deb13u1	vulnerable
	forky, sid	2.44.7+dfsg-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
gdk-pixbuf	source	(unstable)	(unfixed)

Notes

https://bugzilla.redhat.com/show_bug.cgi?id=2517751

Home - Debian Security - Source (Git)

Apply commands

text fix

Notes

https://bugzilla.redhat.com/show_bug.cgi?id=2517751

OS impact

Debian Affected 4 releases

Version	Status	Fixed in
trixie	Affected	—
sid	Affected	—
forky	Affected	—
bookworm	Affected	—

SUSE Affected 1 release

Version	Status	Fixed in
—	Affected	—

References

CWEs

CWE-125

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.