CVE-2026-80101 Gimp: multiple heap out-of-bounds reads in xwd loader from unrelated width and bytes-per-line validation

Description

A flaw was found in the file-xwd plugin in GIMP. When processing a specially crafted XWD image file, the plugin validates the image width and bytes-per-line parameters independently rather than ensuring their combined values are consistent with the allocated buffer size. This incorrect validation leads to improper bounds checking, causing a heap out-of-bounds read. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of heap memory contents into the produced image.

Exploitable with local access to the machine, without an account and if a user takes an action; the impact on data or service is limited.

Attack vector

Local

Attack complexity

Low

Privileges required

None

Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

Low

Affected products and versions