Filtered by vendor Gimp Subscriptions
Total 133 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-58381 2 Gimp, Redhat 3 Gimp, Enterprise Linux, Rhel Els 2026-11-06 6.1 Medium
A flaw was found in GIMP's PSP file format parser. A double-free condition occurs in the read_layer_block() function when processing a specially crafted PSP file. This could allow an attacker to cause memory corruption, potentially leading to denial of service or arbitrary code execution.
CVE-2026-58380 3 Gimp, Gnome, Redhat 6 Gimp, Gimp, Enterprise Linux and 3 more 2026-11-06 7.3 High
A flaw was found in GIMP's PNM file format parser. When parsing a specially crafted PNM file, the pnmscanner_gettoken() function writes a null terminator one byte past the end of a stack-allocated buffer due to an off-by-one error in the loop boundary check. This could lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.
CVE-2026-66759 2 Gimp, Redhat 3 Gimp, Enterprise Linux, Rhel Els 2026-11-06 7.1 High
A flaw was found in the file-icns plugin in GIMP. When applying a decompressed mask during ICNS image processing, the plugin reads from the mask data buffer without verifying if the cursor exceeds the allocated resource size. If a crafted file contains a truncated mask resource, the icns_decompress function continues reading past the bounds of the buffer. This out-of-bounds read vulnerability results in information disclosure of heap contents, where memory contents are leaked as alpha channel pixel values, or a crash leading to a denial of service if unmapped memory is accessed.
CVE-2026-66757 2 Gimp, Redhat 3 Gimp, Enterprise Linux, Rhel Els 2026-11-06 5.5 Medium
A flaw was found in the file-sgi plugin in GIMP. When processing an RLE-compressed SGI image, the plugin allocates memory for a row table. The image header dimensions (ysize and zsize) are read as 16-bit unsigned integers. If a crafted file sets both dimensions to their maximum value (65535), the multiplication ysize * zsize overflows the standard 32-bit int boundary before being passed to calloc. This integer overflow issue results in undefined behavior, aborting the plugin and causing a denial of service.
CVE-2026-6695 2 Gimp, Redhat 3 Gimp, Enterprise Linux, Rhel Els 2026-11-06 5.5 Medium
A flaw was found in GIMP. A remote attacker could exploit this by tricking a user into opening a specially crafted PAA (Paint Shop Pro Array) image file. This vulnerability, a heap-based out-of-bounds write in the decode_lzss() function of the PAA file format plugin, allows data to be written beyond the intended memory buffer. This could lead to heap metadata corruption and potentially enable the attacker to execute arbitrary code on the affected system.
CVE-2026-6694 2 Gimp, Redhat 3 Gimp, Enterprise Linux, Rhel Els 2026-11-06 5.5 Medium
A flaw was found in GIMP's file-png plugin. A remote attacker can exploit this by crafting a malicious Animated Portable Network Graphics (APNG) image containing an oversized tRNS chunk. This can lead to a stack-based buffer overflow (CWE-121), causing the file-png plugin to crash and resulting in a Denial of Service (DoS) for the user.
CVE-2026-40919 2 Gimp, Redhat 3 Gimp, Enterprise Linux, Rhel Els 2026-11-06 6.1 Medium
A flaw was found in GIMP. This vulnerability, a buffer overflow in the `file-seattle-filmworks` plugin, can be exploited when a user opens a specially crafted Seattle Filmworks file. A remote attacker could leverage this to cause a denial of service (DoS), leading to the plugin crashing and potentially impacting the stability of the GIMP application.
CVE-2026-40918 2 Gimp, Redhat 3 Gimp, Enterprise Linux, Rhel Els 2026-11-06 5.5 Medium
A flaw was found in GIMP. Processing a specially crafted PVR image file with large dimensions can lead to a denial of service (DoS). This occurs due to a stack-based buffer overflow and an out-of-bounds read in the PVR image loader, causing the application to crash. Systems that process untrusted PVR image files are affected.
CVE-2026-40917 2 Gimp, Redhat 3 Gimp, Enterprise Linux, Rhel Els 2026-11-06 5 Medium
A flaw was found in GIMP. This vulnerability, a heap buffer over-read in the `icns_slurp()` function, occurs when processing specially crafted ICNS image files. An attacker could provide a malicious ICNS file, potentially leading to application crashes or information disclosure on systems that process such files.
CVE-2026-40916 2 Gimp, Redhat 3 Gimp, Enterprise Linux, Rhel Els 2026-11-06 5 Medium
A flaw was found in GIMP. A stack buffer overflow vulnerability in the TIM image loader's 4BPP decoding path allows a local user to cause a Denial of Service (DoS). By opening a specially crafted TIM image file, the application crashes due to an unconditional overflow when writing to a variable-length array.
CVE-2026-40915 2 Gimp, Redhat 3 Gimp, Enterprise Linux, Rhel Els 2026-11-06 5.5 Medium
A flaw was found in GIMP. A remote attacker could exploit an integer overflow vulnerability in the FITS image loader by providing a specially crafted FITS file. This integer overflow leads to a zero-byte memory allocation, which is then subjected to a heap buffer overflow when processing pixel data. Successful exploitation could result in a denial of service (DoS) or potentially arbitrary code execution.
CVE-2026-4887 3 Gimp, Gnome, Redhat 9 Gimp, Gimp, Enterprise Linux and 6 more 2026-11-06 6.1 Medium
A flaw was found in GIMP. This issue is a heap buffer over-read in GIMP PCX file loader due to an off-by-one error. A remote attacker could exploit this by convincing a user to open a specially crafted PCX image. Successful exploitation could lead to out-of-bounds memory disclosure and a possible application crash, resulting in a Denial of Service (DoS).
CVE-2026-42169 2 Gimp, Redhat 6 Gimp, Enterprise Linux, Enterprise Linux Eus and 3 more 2026-11-05 7.3 High
A heap-buffer-overflow vulnerability exists in the APNG (Animated PNG) file loader of GIMP. This flaw occurs when the `fcTL` width exceeds the `IHDR` width, leading to pixel data being written past the end of a heap allocation. Additionally, a heap-based buffer overflow exists in the DDS plug-in due to a BPP mismatch in the `load_layer()` function. Both vulnerabilities can be triggered by opening a specially crafted image file, potentially leading to code execution.
CVE-2026-2272 2 Gimp, Redhat 3 Gimp, Enterprise Linux, Rhel Els 2026-11-05 4.3 Medium
A flaw was found in GIMP. An integer overflow vulnerability exists when processing ICO image files, specifically in the `ico_read_info` and `ico_read_icon` functions. This issue arises because a size calculation for image buffers can wrap around due to a 32-bit integer evaluation, allowing oversized image headers to bypass security checks. A remote attacker could exploit this by providing a specially crafted ICO file, leading to a buffer overflow and memory corruption, which may result in an application level denial of service.
CVE-2026-2271 2 Gimp, Redhat 3 Gimp, Enterprise Linux, Rhel Els 2026-11-05 3.3 Low
A flaw was found in GIMP's PSP (Paint Shop Pro) file parser. A remote attacker could exploit an integer overflow vulnerability in the read_creator_block() function by providing a specially crafted PSP image file. This vulnerability occurs when a 32-bit length value from the file is used for memory allocation without proper validation, leading to a heap overflow and an out-of-bounds write. Successful exploitation could result in an application level denial of service.
CVE-2025-6035 2 Gimp, Redhat 3 Gimp, Enterprise Linux, Rhel Els 2026-11-05 6.1 Medium
A flaw was found in GIMP. An integer overflow vulnerability exists in the GIMP "Despeckle" plug-in. The issue occurs due to unchecked multiplication of image dimensions, such as width, height, and bytes-per-pixel (img_bpp), which can result in allocating insufficient memory and subsequently performing out-of-bounds writes. This issue could lead to heap corruption, a potential denial of service (DoS), or arbitrary code execution in certain scenarios.
CVE-2026-112259 2 Gimp, Redhat 3 Gimp, Enterprise Linux, Rhel Els 2026-11-05 5.5 Medium
A flaw was found in GIMP. Importing a crafted SBZ palette without a color-model attribute can cause a NULL pointer dereference during string comparison, resulting in denial of service of the GIMP application.
CVE-2026-108093 2 Gimp, Redhat 3 Gimp, Enterprise Linux, Rhel Els 2026-11-05 5.5 Medium
A flaw was found in GIMP. The XCF loader processes image-simulation-intent and image-simulation-bpc parasites without ensuring the parasite data is present before dereferencing it. Opening a specially crafted XCF file with a zero-size simulation parasite can cause a NULL pointer dereference and crash the GIMP application.
CVE-2026-106067 2 Gimp, Redhat 3 Gimp, Enterprise Linux, Rhel Els 2026-11-05 6.3 Medium
A heap-based buffer overflow was found in GIMP’s Hot color filter plug-in. For very large images, a pixel buffer is allocated using overflowing 32-bit width * height (and related) arithmetic while the filter’s pixel access path uses the true image size, after integer overflow in the allocation size
CVE-2026-106066 2 Gimp, Redhat 3 Gimp, Enterprise Linux, Rhel Els 2026-11-05 6.3 Medium
A heap-based buffer overflow was found in GIMP’s raw data export plug-in. When exporting very large images, g_malloc() sizing based on overflowing width * height * bytes-per-pixel can allocate far less memory than GEGL reads or writes during export, following integer overflow