EUVD-2026-63449
GHSA-28mq-m8mv-9qrq
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Victim must locally open a crafted file (AV:L, UI:R); no attacker privileges needed; successful exploitation fully compromises the GIMP process (C:H/I:H/A:H) without scope change.
Primary rating from Vendor (zdi).
CVSS VectorVendor: zdi
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
GIMP HDR File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of HDR files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29289.
AnalysisAI
Remote code execution in GIMP 3.2.2 is possible when a user opens a specially crafted HDR image file, with the underlying flaw residing in the GEGL image processing library that GIMP depends on. The integer overflow in HDR buffer size computation (CWE-190) produces an undersized heap allocation that an attacker can leverage to execute arbitrary code in the context of the victim's GIMP process. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to actively open a specially crafted HDR (High Dynamic Range) image file in GIMP 3.2.2 - this is the sole mandatory condition. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.8 High score is anchored by a full High triad (C:H/I:H/A:H) but meaningfully constrained by AV:L (local attack vector) and UI:R (user interaction required), meaning opportunistic mass exploitation over the network is not possible - the attacker must socially engineer the victim into opening a crafted HDR file. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts an HDR image file containing field values engineered to trigger an integer overflow during buffer size calculation in GEGL's HDR parser, then delivers it to a target graphic designer via email attachment, a file-sharing link, or a download prompt on a malicious webpage. When the victim opens the file in GIMP 3.2.2, the overflow produces an undersized heap allocation, enabling the attacker to overwrite adjacent memory and achieve arbitrary code execution running under the victim's user account. … |
| Remediation | An upstream fix is available via a commit to the GNOME/gegl repository (https://gitlab.gnome.org/GNOME/gegl/-/commit/d3d262008299341c5b032b354021632ceadb2799); however, a released patched GIMP version incorporating this fix is not independently confirmed from available data - the fix version should be verified against both GIMP and GEGL release notes before declaring remediation complete. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory GIMP 3.2.2 deployments and distribute an alert instructing users not to open HDR files from external sources; add .hdr file blocking at email and web gateways. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Buffer overflow in the readstr_upto function in plug-ins/script-fu/tinyscheme/scheme.c in GIMP 2.6.12 and earlier, and p
Multiple stack-based buffer overflows in file-xwd.c in the X Window Dump (XWD) plug-in in GIMP 2.8.2 allow remote attack
In GIMP 2.8.22, there is a heap-based buffer overflow in read_channel_data in plug-ins/common/file-psp.c. Rated high sev
fits-io.c in GIMP before 2.8.1 allows remote attackers to cause a denial of service (NULL pointer dereference and applic
An issue in gimp_layer_invalidate_boundary of GNOME GIMP 2.10.30 allows attackers to trigger an unhandled exception via
GIMP 2.10.30 and 2.99.10 are vulnerable to Buffer Overflow. Rated medium severity (CVSS 5.5), this vulnerability is no a
GIMP through 2.10.2 makes g_get_tmp_dir calls to establish temporary filenames, which may result in a filename that alre
Critical remote code execution vulnerability in GIMP's ICO file parser caused by an integer overflow (CWE-190) that lack
Remote code execution in GIMP 3.0.6 allows attackers to run arbitrary code by tricking a user into opening a malicious P
Remote code execution in GIMP 3.2.0-rc1 lets attackers run arbitrary code by tricking a user into opening a malicious IC
Use-after-free vulnerability in the xcf_load_image function in app/xcf/xcf-load.c in GIMP allows remote attackers to cau
Heap-based buffer overflow in GIMP's TIF file parser enables remote code execution when a user opens a crafted TIFF imag
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Integer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today