Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file-parsing bug needing the victim to open a crafted file (AV:L/UI:R), no attacker privileges (PR:N), and full compromise of the user session (C/I/A:H).
AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (redhat).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
A flaw was found in GIMP's PNM file format parser. When parsing a specially crafted PNM file, the pnmscanner_gettoken() function writes a null terminator one byte past the end of a stack-allocated buffer due to an off-by-one error in the loop boundary check. This could lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.
AnalysisAI
Stack-based memory corruption in GIMP's PNM image parser lets an attacker execute code or crash the application when a victim opens a malicious PNM/PBM/PGM/PPM file. The flaw is an off-by-one in pnmscanner_gettoken() that writes a null terminator one byte past a stack buffer; it is local and requires the user to open the crafted file (UI:R). No public exploit is identified at time of analysis, and EPSS is low (0.12%), consistent with the CISA SSVC 'Exploitation: none' judgment.
Technical ContextAI
The vulnerable code is GIMP's PNM (Portable Any Map) loader, which handles the PBM/PGM/PPM/PAM ASCII and binary image formats. During tokenization, pnmscanner_gettoken() reads header/data tokens into a fixed-size stack buffer and appends a terminating NUL byte. The loop boundary check is off by one (CWE-193, Off-by-one Error), so with a token that exactly fills the buffer the NUL is written to buffer[len], one byte beyond the allocation. On the stack this can overwrite an adjacent local, saved register, or canary, producing the classic memory-corruption chain from crash (DoS) to potential control-flow hijack. The affected component ships as the gimp package; the reporter is Red Hat and the CPE set enumerates the RHEL distributions that carry it.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - apply the GNOME/GIMP fix from commit https://gitlab.gnome.org/GNOME/gimp/-/commit/83699817 once packaged. On Red Hat Enterprise Linux 6/7/8/9, update the gimp package to the fixed build published via the Red Hat advisory (https://access.redhat.com/security/cve/CVE-2026-58380) when it ships; track the Bugzilla at https://bugzilla.redhat.com/show_bug.cgi?id=2496135 for the exact errata version. Because exploitation requires opening a malicious file, effective compensating controls until patched are operational: do not open PNM/PBM/PGM/PPM files from untrusted sources, and disable or restrict the PNM plug-in if your GIMP deployment supports plug-in removal (trade-off: loss of PNM import/export). Where GIMP is used for automated/batch image processing, sandbox the process or route it through a hardened converter, since batch pipelines remove the human 'do you trust this file' check that normally limits UI:R bugs.
More in Red Hat Enterprise Linux 6
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Arbitrary code execution in GIMP's PSD import plugin allows an attacker to run code in the context of the user who opens
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Denial of service in Red Hat / 389 Directory Server (389-ds-base, versions since ~1.3.2/2013) allows an authenticated LD
Local-to-domain-wide root privilege escalation in SSSD's LDAP sudo provider allows an authenticated LDAP directory user
Heap buffer overflow in GStreamer's librfb (RFB/VNC client) allows a malicious VNC server to corrupt heap memory on a co
Same weakness CWE-193 – Off-by-one Error
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Liberty Linux 9 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | Affected |
| SUSE Linux Enterprise Workstation Extension 15 SP7 | Affected |
| SUSE Linux Enterprise Server 15 SP7 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP7 | Affected |
| SUSE Linux Enterprise Desktop 15 SP7 | Affected |
| SUSE Linux Enterprise Desktop 15 SP7 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | Affected |
| SUSE Linux Enterprise Server 15 SP7 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP7 | Affected |
| SUSE Linux Enterprise Workstation Extension 15 SP7 | Affected |
| SUSE Linux Enterprise Server 15 SP4 | Affected |
| SUSE Linux Enterprise Server 15 SP5 | Affected |
| SUSE Linux Enterprise Server 15 SP6 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | Affected |
| SUSE Linux Enterprise Desktop 15 SP4 | Affected |
| SUSE Linux Enterprise Desktop 15 SP5 | Affected |
| SUSE Linux Enterprise Desktop 15 SP6 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP4 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | Affected |
| SUSE Linux Enterprise Workstation Extension 15 SP4 | Affected |
| SUSE Linux Enterprise Workstation Extension 15 SP5 | Affected |
| SUSE Linux Enterprise Workstation Extension 15 SP6 | Affected |
| openSUSE Leap 15.4 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today
EUVD-2026-41875
GHSA-c7fj-r3pq-5ph5