An out‑of‑bounds write occurs in gdk‑pixbuf when decoding a JPEG image that contains chunked ICC profile markers. If an error happens while parsing the ICC profile, the library may leave stale size metadata after the profile buffer is freed. Subsequent allocations during the same decode can then overwrite memory just outside the bounds of the buffer, which can cause the application to crash or lead to a denial of service. The vulnerability does not provide a direct remote or privileged code‑execution path and appears to be limited to the application that loads the malicious JPEG.

Red Hat Enterprise Linux releases 6, 7, 8, 9, and 10 are affected because they ship gdk‑pixbuf versions 2.26.4 and later. Any application linked against this vulnerable lib on those distributions can be impacted when processing JPEG images that contain the described ICC markers.

CVSS 4.7 indicates a moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, which suggests no active exploitation campaigns have been observed. Attackers would need local access to supply a crafted JPEG to an affected application, so the risk is primarily local or within a compromised host. Existing mitigations redirect focus to blocking untrusted image handling until a patched package appears.