Skip to main content

GIMP CVE-2026-58380

| EUVDEUVD-2026-41875 HIGH
Off-by-one Error (CWE-193)
2026-07-06 redhat GHSA-c7fj-r3pq-5ph5
7.8
CVSS 3.1 · NVD
Share

Severity by source

Vendor (redhat) PRIMARY
HIGH
qualitative
NVD
7.8 HIGH
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local file-parsing bug needing the victim to open a crafted file (AV:L/UI:R), no attacker privileges (PR:N), and full compromise of the user session (C/I/A:H).

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
7.3 HIGH
AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Red Hat
7.3 MEDIUM
qualitative

Primary rating from Vendor (redhat).

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
Analysis Updated
Jul 10, 2026 - 17:43 vuln.today
v3 (cvss_changed)
Analysis Updated
Jul 10, 2026 - 17:43 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 10, 2026 - 17:37 vuln.today
cvss_changed
CVSS changed
Jul 10, 2026 - 17:37 NVD
7.3 (HIGH) 7.8 (HIGH)
Analysis Generated
Jul 06, 2026 - 14:52 vuln.today
CVE Published
Jul 06, 2026 - 13:58 cve.org
HIGH 7.3

DescriptionNVD

A flaw was found in GIMP's PNM file format parser. When parsing a specially crafted PNM file, the pnmscanner_gettoken() function writes a null terminator one byte past the end of a stack-allocated buffer due to an off-by-one error in the loop boundary check. This could lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.

AnalysisAI

Stack-based memory corruption in GIMP's PNM image parser lets an attacker execute code or crash the application when a victim opens a malicious PNM/PBM/PGM/PPM file. The flaw is an off-by-one in pnmscanner_gettoken() that writes a null terminator one byte past a stack buffer; it is local and requires the user to open the crafted file (UI:R). No public exploit is identified at time of analysis, and EPSS is low (0.12%), consistent with the CISA SSVC 'Exploitation: none' judgment.

Technical ContextAI

The vulnerable code is GIMP's PNM (Portable Any Map) loader, which handles the PBM/PGM/PPM/PAM ASCII and binary image formats. During tokenization, pnmscanner_gettoken() reads header/data tokens into a fixed-size stack buffer and appends a terminating NUL byte. The loop boundary check is off by one (CWE-193, Off-by-one Error), so with a token that exactly fills the buffer the NUL is written to buffer[len], one byte beyond the allocation. On the stack this can overwrite an adjacent local, saved register, or canary, producing the classic memory-corruption chain from crash (DoS) to potential control-flow hijack. The affected component ships as the gimp package; the reporter is Red Hat and the CPE set enumerates the RHEL distributions that carry it.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the GNOME/GIMP fix from commit https://gitlab.gnome.org/GNOME/gimp/-/commit/83699817 once packaged. On Red Hat Enterprise Linux 6/7/8/9, update the gimp package to the fixed build published via the Red Hat advisory (https://access.redhat.com/security/cve/CVE-2026-58380) when it ships; track the Bugzilla at https://bugzilla.redhat.com/show_bug.cgi?id=2496135 for the exact errata version. Because exploitation requires opening a malicious file, effective compensating controls until patched are operational: do not open PNM/PBM/PGM/PPM files from untrusted sources, and disable or restrict the PNM plug-in if your GIMP deployment supports plug-in removal (trade-off: loss of PNM import/export). Where GIMP is used for automated/batch image processing, sandbox the process or route it through a hardened converter, since batch pipelines remove the human 'do you trust this file' check that normally limits UI:R bugs.

CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash

CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft

CVE-2026-59090 CRITICAL
9.9 Aug 10

Arbitrary code execution in GIMP's PSD import plugin allows an attacker to run code in the context of the user who opens

CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo

CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a

CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe

CVE-2026-33845 CRITICAL
9.1 Apr 30

Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege

CVE-2026-16526 HIGH
8.8 Jul 30

Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe

CVE-2026-11610 HIGH
8.8 Jul 07

Denial of service in Red Hat / 389 Directory Server (389-ds-base, versions since ~1.3.2/2013) allows an authenticated LD

CVE-2026-14474 HIGH
8.8 Jul 07

Local-to-domain-wide root privilege escalation in SSSD's LDAP sudo provider allows an authenticated LDAP directory user

CVE-2026-52720 HIGH
8.8 Jun 15

Heap buffer overflow in GStreamer's librfb (RFB/VNC client) allows a malicious VNC server to corrupt heap memory on a co

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Liberty Linux 9 Fixed
openSUSE Leap 16.0 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected
SUSE Linux Enterprise Workstation Extension 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

CVE-2026-58380 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy