EUVD-2026-39130
GHSA-j4fq-jj5r-8w3h
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must be opened locally so AV:L and UI:R; no privileges needed (PR:N), and code execution as the user yields full C/I/A impact within unchanged scope.
Primary rating from Vendor (zdi).
CVSS VectorVendor: zdi
Lifecycle Timeline
1DescriptionCVE.org
GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of HDR files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28266.
AnalysisAI
Arbitrary code execution in GIMP results from a heap-based buffer overflow in the HDR file parser, where attacker-controlled length data is copied into an undersized heap buffer without bounds validation. Any user who opens a maliciously crafted HDR image (or visits a page that delivers one) can be exploited, with code running in the context of the GIMP process. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Technical ContextAI
GIMP relies on GEGL (Generic Graphics Library) for many of its image-loading operations, and the fix referenced here lives in GEGL merge request 241, indicating the defective HDR (Radiance/RGBE high-dynamic-range) parsing logic is in that shared library rather than GIMP core. The root cause is CWE-122 (heap-based buffer overflow): the parser reads a length or dimension value from the untrusted HDR file and uses it to drive a copy into a heap allocation without first validating that the source length fits the destination, allowing adjacent heap metadata and objects to be corrupted. The affected CPE is cpe:2.3:a:gimp:gimp (all versions noted), and because GEGL is the actual fix location, other GEGL consumers may share exposure.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - the correction has been merged in GEGL via merge request 241 (https://gitlab.gnome.org/GNOME/gegl/-/merge_requests/241), so upgrade GIMP and its bundled GEGL to a build that incorporates that merge once your distribution publishes it, and consult ZDI-26-282 (https://www.zerodayinitiative.com/advisories/ZDI-26-282/) for tracking. Until a patched package is installed, the practical compensating control is to avoid opening untrusted HDR/.hdr (Radiance RGBE) files in GIMP and to treat HDR attachments and downloads as untrusted; where feasible, restrict or remove the HDR/GEGL load path or open suspicious images only in a sandboxed/disposable environment, accepting the trade-off that HDR import becomes unavailable or slower. Do not rely on file extension alone, since content can be disguised.
Buffer overflow in the readstr_upto function in plug-ins/script-fu/tinyscheme/scheme.c in GIMP 2.6.12 and earlier, and p
Multiple stack-based buffer overflows in file-xwd.c in the X Window Dump (XWD) plug-in in GIMP 2.8.2 allow remote attack
In GIMP 2.8.22, there is a heap-based buffer overflow in read_channel_data in plug-ins/common/file-psp.c. Rated high sev
fits-io.c in GIMP before 2.8.1 allows remote attackers to cause a denial of service (NULL pointer dereference and applic
An issue in gimp_layer_invalidate_boundary of GNOME GIMP 2.10.30 allows attackers to trigger an unhandled exception via
GIMP 2.10.30 and 2.99.10 are vulnerable to Buffer Overflow. Rated medium severity (CVSS 5.5), this vulnerability is no a
GIMP through 2.10.2 makes g_get_tmp_dir calls to establish temporary filenames, which may result in a filename that alre
Critical remote code execution vulnerability in GIMP's ICO file parser caused by an integer overflow (CWE-190) that lack
Remote code execution in GIMP 3.0.6 allows attackers to run arbitrary code by tricking a user into opening a malicious P
Remote code execution in GIMP 3.2.0-rc1 lets attackers run arbitrary code by tricking a user into opening a malicious IC
Use-after-free vulnerability in the xcf_load_image function in app/xcf/xcf-load.c in GIMP allows remote attackers to cau
Heap-based buffer overflow in GIMP's TIF file parser enables remote code execution when a user opens a crafted TIFF imag
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Heap Overflow
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Desktop 15 SP7 | Not-Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | Not-Affected |
| SUSE Linux Enterprise Server 15 SP7 | Not-Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP7 | Not-Affected |
| SUSE Linux Enterprise Workstation Extension 15 SP7 | Not-Affected |
| SUSE Linux Enterprise Server 15 SP4 | Not-Affected |
| SUSE Linux Enterprise Server 15 SP5 | Not-Affected |
| SUSE Linux Enterprise Server 15 SP6 | Not-Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | Not-Affected |
| SUSE Linux Enterprise Desktop 15 SP4 | Not-Affected |
| SUSE Linux Enterprise Desktop 15 SP5 | Not-Affected |
| SUSE Linux Enterprise Desktop 15 SP6 | Not-Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP4 | Not-Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Not-Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Not-Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | Not-Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | Not-Affected |
| SUSE Linux Enterprise Workstation Extension 15 SP4 | Not-Affected |
| SUSE Linux Enterprise Workstation Extension 15 SP5 | Not-Affected |
| SUSE Linux Enterprise Workstation Extension 15 SP6 | Not-Affected |
| openSUSE Leap 15.4 | Not-Affected |
| openSUSE Leap 15.5 | Not-Affected |
| openSUSE Leap 15.6 | Not-Affected |
Share
External POC / Exploit Code
Leaving vuln.today