EUVD-2026-36156
GHSA-m2vh-q87q-6r5q
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must be opened locally by the user (AV:L, UI:R); no prior privileges needed (PR:N); parsing is deterministic (AC:L); arbitrary code execution yields full CIA impact in user context (C:H/I:H/A:H, S:U).
Primary rating from Vendor (zdi).
CVSS VectorVendor: zdi
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of HDR files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28618.
AnalysisAI
Arbitrary code execution in GIMP via malicious HDR (High Dynamic Range) image files allows attackers to run code in the context of the user opening the file. The flaw is a heap-based buffer overflow (CWE-122) in the HDR parser, requiring the victim to open a crafted file or visit a malicious page that delivers one. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to open a maliciously crafted Radiance HDR (.hdr) file in GIMP or trigger the GEGL HDR loader through an application that uses it; the CVSS UI:R metric confirms required user interaction, so silent or drive-by exploitation against a stock GIMP install is not in scope. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.0 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 7.8) reflects local attack vector with required user interaction but full CIA impact at the executing user's privilege level - typical of client-side file-format bugs. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a malicious .hdr file with an oversized field that overflows the heap buffer in GEGL's HDR loader, then delivers it via phishing email, a watering-hole download site, or a shared asset repository used by designers. When the victim opens the file in GIMP - or in any other application that calls the vulnerable GEGL loader - the overflow corrupts heap metadata and is steered into arbitrary code execution in the victim's user context. … |
| Remediation | No vendor-released patch identified at time of analysis - the GEGL upstream tracker (https://gitlab.gnome.org/GNOME/gegl/-/issues/450) is the authoritative location to monitor for a fixed GEGL release and corresponding GIMP version, and the ZDI advisory at https://www.zerodayinitiative.com/advisories/ZDI-26-214/ should be checked for vendor coordination updates. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Issue security alert to all GIMP users, advise against opening HDR files from untrusted sources. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today