Skip to main content

GIMP CVE-2026-2045

HIGH
Out-of-bounds Write (CWE-787)
2026-02-20 zdi-disclosures@trendmicro.com
RCE Gimp Buffer Overflow Memory Corruption
7.3
CVSS 3.1 · Vendor: trendmicro
Share

Severity by source

Vendor (trendmicro) PRIMARY
7.3 HIGH
AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

File-parser RCE triggered by a victim opening a crafted XWD file: local vector and required user interaction, but no prior privilege needed (PR:N), with full code execution giving high C/I/A.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
7.8 HIGH
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Red Hat
7.3 HIGH
qualitative

Primary rating from Vendor (trendmicro).

CVSS VectorVendor: trendmicro

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

9
Analysis Updated
Jun 30, 2026 - 05:30 vuln.today
v5 (cvss_changed)
Analysis Updated
Jun 30, 2026 - 05:30 vuln.today
v4 (cvss_changed)
Analysis Updated
Jun 30, 2026 - 05:29 vuln.today
v3 (cvss_changed)
Analysis Updated
Jun 30, 2026 - 05:29 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jun 30, 2026 - 03:23 vuln.today
cvss_changed
CVSS changed
Jun 30, 2026 - 03:23 NVD
7.8 (HIGH) 7.3 (HIGH)
Analysis Generated
Mar 12, 2026 - 22:04 vuln.today
Patch released
Feb 24, 2026 - 21:41 nvd
Patch available
CVE Published
Feb 20, 2026 - 23:16 nvd
HIGH 7.8

DescriptionCVE.org

GIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of XWD files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28265.

AnalysisAI

Out-of-bounds write in GIMP 3.0.6's XWD (X Window Dump) image file parser allows remote attackers to execute arbitrary code in the context of the user running GIMP, provided the victim is lured into opening a malicious XWD file or visiting a page that delivers one. The CVSS 3.1 vector (AV:L/UI:R) shows this is not a remote-network attack but a user-interaction-driven file-parsing flaw, scored 7.3 (High). There is no public exploit identified at time of analysis, and EPSS is very low (0.08%, 23rd percentile), consistent with an attack that depends on social engineering rather than mass automation.

Technical ContextAI

GIMP is a cross-platform open-source raster image editor. The vulnerable code path is the loader that parses XWD files - the native screen-dump format produced by the X11 xwd utility - which carries a header describing image geometry, color depth, and colormap that the loader uses to size and populate buffers. The root cause is CWE-787 (Out-of-Bounds Write): the loader fails to properly validate attacker-controlled header/length fields, so crafted dimensions or colormap counts cause a write past the end of a heap-allocated buffer, corrupting adjacent memory. The single CPE in scope, cpe:2.3:a:gimp:gimp:3.0.6, identifies the GIMP 3.0.x line as affected; the upstream fix is GNOME GitLab commit 68b27dfb1cbd9b3f22d7fa624dbab8647ee5f275, which adds the missing bounds checking in the XWD plug-in.

RemediationAI

Apply the vendor patch: on distributions, update GIMP to the fixed package per your platform's advisory - Red Hat users should apply the relevant erratum (e.g., RHSA-2026:4173 / RHSA-2026:5113 / RHSA-2026:5388-5391 / RHSA-2026:5434-5437 at https://access.redhat.com/errata/RHSA-2026:5113) and SUSE users SUSE-SU-2026:0684 (https://www.suse.com/support/update/SUSE-SU-2026:0684/); for source/Flatpak builds, take the release incorporating GNOME GitLab commit 68b27dfb1cbd9b3f22d7fa624dbab8647ee5f275. Until patched, the practical compensating control is to not open XWD files from untrusted sources and to treat inbound image files as untrusted - XWD is a niche screen-dump format rarely needed in normal workflows, so blocking or quarantining .xwd attachments at the mail/web gateway has minimal operational impact. Because exploitation requires the user to open the malicious file, user awareness (do not open unexpected image files) and running GIMP without elevated privileges meaningfully reduce blast radius; sandboxing GIMP (e.g., via the Flatpak sandbox) further limits the impact of successful code execution at the cost of some filesystem-access friction.

More in Gimp

View all
CVE-2012-2763 HIGH POC
7.5 Jul 12

Buffer overflow in the readstr_upto function in plug-ins/script-fu/tinyscheme/scheme.c in GIMP 2.6.12 and earlier, and p
CVE-2012-5576 HIGH POC
7.5 Dec 18

Multiple stack-based buffer overflows in file-xwd.c in the X Window Dump (XWD) plug-in in GIMP 2.8.2 allow remote attack
CVE-2017-17789 HIGH POC
7.8 Dec 20

In GIMP 2.8.22, there is a heap-based buffer overflow in read_channel_data in plug-ins/common/file-psp.c. Rated high sev
CVE-2012-3236 MEDIUM POC
4.3 Jul 12

fits-io.c in GIMP before 2.8.1 allows remote attackers to cause a denial of service (NULL pointer dereference and applic
CVE-2022-32990 MEDIUM POC
5.5 Jun 24

An issue in gimp_layer_invalidate_boundary of GNOME GIMP 2.10.30 allows attackers to trigger an unhandled exception via

CVE-2022-30067 MEDIUM POC
5.5 May 17

GIMP 2.10.30 and 2.99.10 are vulnerable to Buffer Overflow. Rated medium severity (CVSS 5.5), this vulnerability is no a
CVE-2018-12713 CRITICAL
9.1 Jun 24

GIMP through 2.10.2 makes g_get_tmp_dir calls to establish temporary filenames, which may result in a filename that alre
CVE-2025-5473 HIGH
8.8 Jun 06

Critical remote code execution vulnerability in GIMP's ICO file parser caused by an integer overflow (CWE-190) that lack
CVE-2026-2044 HIGH
8.8 Feb 20

Remote code execution in GIMP 3.0.6 allows attackers to run arbitrary code by tricking a user into opening a malicious P
CVE-2026-0797 HIGH
8.8 Feb 20

Remote code execution in GIMP 3.2.0-rc1 lets attackers run arbitrary code by tricking a user into opening a malicious IC
CVE-2016-4994 HIGH
7.8 Jul 12

Use-after-free vulnerability in the xcf_load_image function in app/xcf/xcf-load.c in GIMP allows remote attackers to cau
CVE-2026-18307 HIGH
7.8 Aug 20

Heap-based buffer overflow in GIMP's TIF file parser enables remote code execution when a user opens a crafted TIFF imag

Same weakness CWE-787 – Out-of-bounds Write

View all
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2012-1889 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8
CVE-2014-1761 HIGH POC
7.8
CVE-2009-3129 HIGH POC
7.8
CVE-2021-1732 HIGH POC
7.8
CVE-2013-3346 CRITICAL POC
9.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Liberty Linux 8 Fixed
SUSE Liberty Linux 9 Fixed
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 SUSE Linux Enterprise Workstation Extension 15 SP7 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed
openSUSE Leap 15.6 Fixed

Share

CVE-2026-2045 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy