Skip to main content

GIMP CVE-2026-2044

HIGH
Use of Uninitialized Resource (CWE-908)
2026-02-20 zdi-disclosures@trendmicro.com
RCE Gimp
8.8
CVSS 3.1 · Vendor: trendmicro
Share

Severity by source

Vendor (trendmicro) PRIMARY
8.8 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vuln.today AI
8.8 HIGH

Malicious file is delivered over the network (AV:N) and parsed with low complexity, but requires the user to open it (UI:R); code execution as the user yields full C/I/A:H with no scope change.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
7.8 HIGH
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Red Hat
8.8 HIGH
qualitative

Primary rating from Vendor (trendmicro).

CVSS VectorVendor: trendmicro

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

9
Analysis Updated
Jun 30, 2026 - 05:32 vuln.today
v5 (cvss_changed)
Analysis Updated
Jun 30, 2026 - 05:31 vuln.today
v4 (cvss_changed)
Analysis Updated
Jun 30, 2026 - 05:31 vuln.today
v3 (cvss_changed)
Analysis Updated
Jun 30, 2026 - 05:31 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jun 30, 2026 - 03:23 vuln.today
cvss_changed
CVSS changed
Jun 30, 2026 - 03:23 NVD
7.8 (HIGH) 8.8 (HIGH)
Analysis Generated
Mar 12, 2026 - 22:04 vuln.today
Patch released
Feb 24, 2026 - 21:41 nvd
Patch available
CVE Published
Feb 20, 2026 - 23:16 nvd
HIGH 7.8

DescriptionCVE.org

GIMP PGM File Parsing Uninitialized Memory Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PGM files. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28158.

AnalysisAI

Remote code execution in GIMP 3.0.6 allows attackers to run arbitrary code by tricking a user into opening a malicious PGM (Portable Gray Map) image file or visiting a page that delivers one. The PGM parser accesses memory before it is properly initialized (CWE-908), letting a crafted file corrupt program state and hijack execution in the context of the current user. Discovered and reported via Trend Micro's Zero Day Initiative (ZDI-26-118 / ZDI-CAN-28158); no public exploit identified at time of analysis and EPSS exploitation probability is low (0.06%, 20th percentile).

Technical ContextAI

GIMP (GNU Image Manipulation Program) is a cross-platform raster graphics editor. The flaw lives in its loader for the Netpbm PGM format, a simple grayscale image format that GIMP parses natively. The CWE-908 'Use of Uninitialized Resource' root cause means the parser reads or operates on a memory buffer (e.g. pixel/header data) whose contents or size were never properly set from the file before being used, producing undefined behavior that an attacker can steer toward control-flow hijack and code execution. The affected build is identified by CPE cpe:2.3:a:gimp:gimp:3.0.6, and the upstream fix is tracked in GNOME GitLab merge request 2569 (commit 112a5e038f0646eae5ae314988ec074433d2b365). Because GIMP ships in major Linux distributions, the same defect propagates into vendor packages, reflected by parallel Red Hat (RHSA-2026:4173, 5113, 5388-5391, 5434-5437) and SUSE (SUSE-SU-2026:0684) errata.

RemediationAI

Patch available per vendor advisory: upgrade GIMP to the fixed release incorporating the upstream change in GNOME GitLab merge request 2569 (commit 112a5e038f0646eae5ae314988ec074433d2b365, https://gitlab.gnome.org/GNOME/gimp/-/merge_requests/2569). The exact fixed GIMP version string is not stated in the provided data and should be confirmed against the GNOME release notes; on enterprise Linux, apply the distribution updates directly - Red Hat customers via RHSA-2026:5113 and related errata (https://access.redhat.com/errata/RHSA-2026:5113) and SUSE customers via SUSE-SU-2026:0684 (https://www.suse.com/support/update/SUSE-SU-2026:0684/). Until patched, the most effective compensating control is to avoid opening PGM/Netpbm images from untrusted sources and to not register GIMP as the default handler for such files, which prevents one-click triggering at the cost of manual file association; organizations can also block or quarantine .pgm (and broader .pnm/.ppm/.pbm) attachments at the mail/web gateway, accepting that this may disrupt legitimate scientific or imaging workflows that rely on the format. Run GIMP under a least-privileged account or sandbox (e.g. the Flatpak confinement) so a successful exploit gains only limited context.

More in Gimp

View all
CVE-2012-2763 HIGH POC
7.5 Jul 12

Buffer overflow in the readstr_upto function in plug-ins/script-fu/tinyscheme/scheme.c in GIMP 2.6.12 and earlier, and p
CVE-2012-5576 HIGH POC
7.5 Dec 18

Multiple stack-based buffer overflows in file-xwd.c in the X Window Dump (XWD) plug-in in GIMP 2.8.2 allow remote attack
CVE-2017-17789 HIGH POC
7.8 Dec 20

In GIMP 2.8.22, there is a heap-based buffer overflow in read_channel_data in plug-ins/common/file-psp.c. Rated high sev
CVE-2012-3236 MEDIUM POC
4.3 Jul 12

fits-io.c in GIMP before 2.8.1 allows remote attackers to cause a denial of service (NULL pointer dereference and applic
CVE-2022-32990 MEDIUM POC
5.5 Jun 24

An issue in gimp_layer_invalidate_boundary of GNOME GIMP 2.10.30 allows attackers to trigger an unhandled exception via

CVE-2022-30067 MEDIUM POC
5.5 May 17

GIMP 2.10.30 and 2.99.10 are vulnerable to Buffer Overflow. Rated medium severity (CVSS 5.5), this vulnerability is no a
CVE-2018-12713 CRITICAL
9.1 Jun 24

GIMP through 2.10.2 makes g_get_tmp_dir calls to establish temporary filenames, which may result in a filename that alre
CVE-2025-5473 HIGH
8.8 Jun 06

Critical remote code execution vulnerability in GIMP's ICO file parser caused by an integer overflow (CWE-190) that lack
CVE-2026-0797 HIGH
8.8 Feb 20

Remote code execution in GIMP 3.2.0-rc1 lets attackers run arbitrary code by tricking a user into opening a malicious IC
CVE-2016-4994 HIGH
7.8 Jul 12

Use-after-free vulnerability in the xcf_load_image function in app/xcf/xcf-load.c in GIMP allows remote attackers to cau
CVE-2026-18307 HIGH
7.8 Aug 20

Heap-based buffer overflow in GIMP's TIF file parser enables remote code execution when a user opens a crafted TIFF imag
CVE-2026-2050 HIGH
7.8 Jun 24

Arbitrary code execution in GIMP results from a heap-based buffer overflow in the HDR file parser, where attacker-contro

Same weakness CWE-908 – Use of Uninitialized Resource

View all
CVE-2011-1255 CRITICAL POC
9.3
CVE-2024-50302 MEDIUM
5.5
CVE-2024-12085 HIGH POC
7.5
CVE-2021-1104 CRITICAL POC
9.8
CVE-2021-29937 CRITICAL POC
9.8
CVE-2021-29936 CRITICAL POC
9.8
CVE-2021-26305 CRITICAL POC
9.8
CVE-2019-9641 CRITICAL POC
9.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Liberty Linux 8 Fixed
SUSE Liberty Linux 9 Fixed
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 SUSE Linux Enterprise Workstation Extension 15 SP7 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed
openSUSE Leap 15.6 Fixed

Share

CVE-2026-2044 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy