Vulnerabilities

A flaw was found in the file-pvr plugin in GIMP. When processing a specially crafted PVR image file, the VQ (compressed) decoder does not properly perform memory bounds checking. This missing validation results in a heap out-of-bounds read. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of heap memory contents.

A flaw was found in the Seattle FilmWorks plugin in GIMP. When processing a specially crafted SFW image file, the plugin allocates a Variable-Length Array (VLA) on the stack without integer overflow checks, causing an unbounded stack allocation. This issue leads to an application crash, resulting in a denial of service.

A flaw was found in the file-xwd plugin in GIMP. When processing a specially crafted XWD image file, the plugin validates the image width and bytes-per-line parameters independently rather than ensuring their combined values are consistent with the allocated buffer size. This incorrect validation leads to improper bounds checking, causing a heap out-of-bounds read. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of heap memory contents into the produced image.

CVE-2026-78465 is an integer overflow (CWE-190) in GIMP's file-pcx plugin, limited to 32-bit builds of the application. When a user opens a crafted PCX image that declares 4 color planes with sufficiently large dimensions, the plugin's allocation-size calculation exceeds the 32-bit integer limit, producing an undersized heap buffer that is then overflowed as image data is written into it. Successful exploitation causes memory corruption that can lead to arbitrary code execution in the context of the GIMP process, or at minimum a crash/denial of service. Only users running 32-bit GIMP builds are affected, and because the CVSS vector is local (AV:L) with user interaction required (UI:R), an attacker needs the victim to open a malicious PCX file. Exploitation has not been reported in the wild; one public proof-of-concept/issue reference exists on the GNOME GitLab tracker, EPSS is a low 0.2%, and the issue is not in CISA KEV.

Do: Users of 32-bit GIMP builds should avoid opening untrusted PCX files until a patched release is available, and should watch the GNOME/GIMP tracker (issue 16578) and Red Hat/vendor advisories for the fix; 64-bit builds are not affected, so switching to a 64-bit build where the OS supports it fully mitigates the flaw. Admins should inventory which endpoints run 32-bit GIMP builds and prioritize those for remediation.

GIMP TIF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29404.

CVE-2026-59090 is an unsigned integer underflow (CWE-191) in the block_rem variable of GIMP's PSD file-format plugin. It is triggered when a user opens a specially crafted .psd image file, causing the parser to lose track of block boundaries and allowing an attacker to inject arbitrary data as layer resource blocks. Successful exploitation can ultimately result in arbitrary code execution on the victim's system. Any system running a vulnerable GIMP build, including the GIMP package shipped with Red Hat Enterprise Linux, is affected if it is used to open untrusted PSD files; the source data does not specify affected or fixed version ranges. No in-the-wild exploitation is reported (not in CISA KEV, EPSS ~0.6%), but a public proof-of-concept reference exists via the GNOME GitLab issue tracker (issue #16509).

Do: Inventory endpoints for GIMP installations, prioritizing users who receive third-party PSD files, and upgrade to a patched GIMP build once Red Hat or GNOME publish fixed versions (no fixed version is given in this data; track GNOME GitLab issue #16509 and Red Hat security advisories). Until patched, treat unsolicited or untrusted .psd files as untrusted input and open them only in a sandboxed environment or with an alternative viewer. Note the reported EPSS probability (0.6%) is low and there is no KEV listing, so this is a hardening priority rather than an active-incident response.

A flaw was found in GIMP. A remote attacker could exploit this by tricking a user into opening a specially crafted PAA (Paint Shop Pro Array) image file. This vulnerability, a heap-based out-of-bounds write in the decode_lzss() function of the PAA file format plugin, allows data to be written beyond the intended memory buffer. This could lead to heap metadata corruption and potentially enable the attacker to execute arbitrary code on the affected system.

An integer overflow (CWE-190) in the file-fits plugin bundled with GIMP causes image width and height values from a FITS file to be multiplied using signed 32-bit arithmetic; when a crafted file sets both dimensions large enough that the product exceeds 2^31, the plugin allocates an undersized heap buffer, and cfitsio's subsequent write of a full pixel row overflows it. The flaw is triggered when a user opens or processes a maliciously crafted FITS image in GIMP, consistent with the CVSS local attack vector requiring user interaction (AV:L/UI:R). Successful exploitation corrupts heap memory and can potentially lead to arbitrary code execution with the victim user's privileges, or crash the application in a denial of service. Anyone running GIMP with the FITS loader enabled is affected, including GIMP packages shipped with Red Hat Enterprise Linux. There are no reports of in-the-wild exploitation (not in CISA KEV; EPSS 0.3%), but a public issue with a proof-of-concept reference exists on the GNOME GitLab tracker.

Do: Update GIMP via your distribution's package channel once a patched release is available and watch for a Red Hat security advisory covering Enterprise Linux (fixed version numbers are not given in the source data). As an interim mitigation, avoid opening untrusted .fits files in GIMP and check whether the file-fits plugin is enabled in your build. Public PoC details are tracked in GNOME GitLab issue 16528.

A flaw was found in GIMP's PSD parser. An integer overflow in read_RLE_channel() can cause an undersized heap allocation for the RLE row-length table, after which subsequent per-row writes corrupt heap memory. This could lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.

A flaw was found in GIMP's PNM file format parser. When parsing a specially crafted PNM file, the pnmscanner_gettoken() function writes a null terminator one byte past the end of a stack-allocated buffer due to an off-by-one error in the loop boundary check. This could lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.

GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of HDR files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28266.

A flaw was found in GIMP. A remote attacker could exploit an integer overflow vulnerability in the FITS image loader by providing a specially crafted FITS file. This integer overflow leads to a zero-byte memory allocation, which is then subjected to a heap buffer overflow when processing pixel data. Successful exploitation could result in a denial of service (DoS) or potentially arbitrary code execution.

GIMP PSD File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PSD files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28807.

A flaw was found in GIMP. This issue is a heap buffer over-read in GIMP PCX file loader due to an off-by-one error. A remote attacker could exploit this by convincing a user to open a specially crafted PCX image. Successful exploitation could lead to out-of-bounds memory disclosure and a possible application crash, resulting in a Denial of Service (DoS).

GIMP ICO File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of ICO files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28599.