A buffer underrun in the gdk‑pixbuf ICO parser causes an out‑of‑bounds read when an ICO file contains pixel values that exceed the defined palette range. The unchecked indices allow the parser to treat heap bytes as palette entries, resulting in the generation of an image that reflects sensitive memory contents. An attacker can craft such a file to extract arbitrary heap data, which may include credentials or other confidential information. The vulnerability is a classic out‑of‑bounds read (CWE‑125).

The flaw affects the GNOME gdk‑pixbuf library and all Red Hat Enterprise Linux releases from 6 through 10 that ship the vulnerable library version. No specific package version is listed in the advisory, so any deployment that has not been updated to the fix should be considered vulnerable.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is below 1 %, suggesting a low probability of exploitation in the current threat landscape, and the issue is not listed in the CISA KEV catalog. Based on the description the attacker would need to deliver a malicious ICO file to an application that performs the vulnerable parse, making the exploit likely local or only feasible where the attacker can trigger the icon loading process. While the impact is limited to information disclosure rather than code execution, the data exposure potential warrants timely remediation.