CVE-2026-90948

GIMP's ICO file loader contains an integer overflow in the calculation of the buffer size needed when processing an ICO file that embeds a PNG image. The overflow results in an undersized heap buffer being allocated, and the decoded pixel data is then written past its bounds, producing a heap-based buffer overflow (CWE-787). An attacker crafts a malicious ICO file and must get a victim to open it in GIMP; successful exploitation can yield arbitrary code execution or a crash running with the victim's privileges. Any user of an affected GIMP release on Linux, Windows, or macOS who opens untrusted icon files is potentially at risk, though the CVSS vector (AV:L/UI:R) confirms user interaction on the local machine is required. There is no known public proof of concept, the flaw is not in CISA's KEV catalog, and no exploitation in the wild has been reported to date.

What to do: Update GIMP to the latest release as soon as a fixed build ships and apply distribution security updates through your package manager. Avoid opening ICO files from untrusted or unknown sources, since exploitation requires the victim to open the crafted file. Check the installed version (Help > About GIMP) and confirm it includes the ICO loader fix before processing icon files from third parties.