6.1
Medium
CVE-2026-78475 Gimp: unbounded stack vla and 21-byte stack over-read in pix (esm) loader
Description
A flaw was found in the file-pix (ESM) plugin in GIMP. When processing a specially crafted PIX image file, the plugin allocates a Variable-Length Array (VLA) on the stack without proper bounds checking, causing an unbounded stack allocation followed by a 21-byte stack over-read. This can result in a denial of service due to stack exhaustion and a limited information disclosure of stack memory contents into an intermediate file.
CVSS 3.1 detail
Vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:HExploitable with local access to the machine, without an account and if a user takes an action; an attacker can seriously compromise confidentiality, integrity or availability.
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- None
- Interaction
- Required
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- None
- Availability
- High
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| GIMP 3.0 | 3.0.0 → latest | No fix stated |
| Red Hat Enterprise Linux 6 | Versions not published | |
| Red Hat Enterprise Linux 7 | Versions not published | |
| Red Hat Enterprise Linux 8 | Versions not published | |
| Red Hat Enterprise Linux 9 | Versions not published |
References
- access.redhat.com access.redhat.com
- RHBZ#2522072 bugzilla.redhat.com
- gitlab.gnome.org gitlab.gnome.org
Timeline
- Published
- Last modified
Other CVEs of GIMP
The 12 CVEs of GIMP →
CVE-2026-92248
Gimp: integer overflow when generating a thumbnail preview for a psd file
7.8
High
CVE-2026-82343
Gimp: heap out-of-bounds read and stack out-of-bounds access in psd loader from channel-count handling
6.1
Medium
CVE-2026-82330
Gimp: heap out-of-bounds read in pvr vq (compressed) decoder due to missing bounds check
6.1
Medium
CVE-2026-82328
Gimp: heap out-of-bounds read in ico loader via unvalidated used_clrs palette count
6.1
Medium