Skip to main content

GIMP EUVDEUVD-2026-36156

| CVE-2026-2049 HIGH
Heap-based Buffer Overflow (CWE-122)
2026-06-10 zdi GHSA-m2vh-q87q-6r5q
RCE Buffer Overflow Heap Overflow Gimp
7.8
CVSS 3.1 · Vendor: zdi
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Craft malicious HDR file
  2. Delivery
    Deliver via phishing or download
  3. Exploit
    Victim opens file in GIMP
  4. Execution
    Trigger heap overflow in GEGL HDR parser
  5. Persist
    Hijack control flow
  6. Impact
    Execute code as current user

Vulnerability Assessment

Weakness
CWE
CWE-122
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires the victim to open a maliciously crafted Radiance HDR (.hdr) file in GIMP or trigger the GEGL HDR loader through an application that uses it; the CVSS UI:R metric confirms required user interaction, so silent or drive-by exploitation against a stock GIMP install is not in scope. AV:L combined with PR:N means the attacker does not need prior credentials on the target machine but does need local file processing - typically achieved by social engineering the user into opening an attachment, download, or shared asset. Limiting factors: the user must actually choose the HDR format / open the file, attacks are bounded to the privileges of the GIMP-running user, and sandboxed GIMP installations (Flatpak default confinement) further constrain post-exploitation reach.
Impact

The CVSS 3.0 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 7.8) reflects local attack vector with required user interaction but full CIA impact at the executing user's privilege level - typical of client-side file-format bugs. There is no EPSS score, KEV listing, or SSVC decision provided in the input, and no public POC has been identified, suggesting this is not yet a mass-exploitation candidate. Realistic risk is moderate: GIMP users routinely open image files from untrusted sources (downloads, email attachments, web-sourced assets), and the GEGL location means any application linking the affected GEGL version could share exposure, but exploitation still requires social engineering to make a user open a malicious .hdr file. The ZDI reporting channel implies the issue is verified but disclosure-coordinated rather than under active exploitation.
Exploit ScenarioDerived

An attacker crafts a malicious .hdr file with an oversized field that overflows the heap buffer in GEGL's HDR loader, then delivers it via phishing email, a watering-hole download site, or a shared asset repository used by designers. When the victim opens the file in GIMP - or in any other application that calls the vulnerable GEGL loader - the overflow corrupts heap metadata and is steered into arbitrary code execution in the victim's user context. No public POC is identified at time of analysis, but ZDI's involvement implies a working researcher exploit exists privately.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 10, 2026

Arbitrary code execution in GIMP via malicious HDR (High Dynamic Range) image files allows attackers to run code in the context of the user opening the file. The flaw is a heap-based buffer overflow (CWE-122) in the HDR parser, requiring the victim to open a crafted file or visit a malicious page that delivers one. No public exploit identified at time of analysis, but the vulnerability was reported through ZDI (ZDI-CAN-28618) indicating verified researcher analysis.

RemediationAI

No vendor-released patch identified at time of analysis - the GEGL upstream tracker (https://gitlab.gnome.org/GNOME/gegl/-/issues/450) is the authoritative location to monitor for a fixed GEGL release and corresponding GIMP version, and the ZDI advisory at https://www.zerodayinitiative.com/advisories/ZDI-26-214/ should be checked for vendor coordination updates. Until a patched build is available, the most effective compensating control is to refuse to open .hdr / Radiance HDR files from untrusted sources; organizations can enforce this by stripping or blocking the .hdr MIME type and extension at email gateways and web proxies (side effect: legitimate HDR workflows for VFX/3D/photography teams break and must be whitelisted). Where GIMP is deployed on multi-user systems, running it under a restricted user account or inside a sandbox such as Flatpak's default confinement, Firejail, or bubblewrap limits the blast radius of successful exploitation to the sandbox boundary rather than the user's full session.

Affected VersionsENISA

GIMP 3.2.0-RC1

Affected Packages

euvd gimp no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

GIMP (GNU Image Manipulation Program) is a widely deployed open-source raster graphics editor. The vulnerability resides in GIMP's HDR (Radiance HDR / .hdr) file format parser, which is implemented in the GEGL (Generic Graphics Library) image processing framework - confirmed by the upstream advisory pointing to gitlab.gnome.org/GNOME/gegl issue #450. CWE-122 (Heap-based Buffer Overflow) identifies the root cause: the parser copies attacker-controlled data from the HDR file into a heap allocation without first validating that the source length fits the destination buffer, enabling heap corruption that can be steered into arbitrary code execution.

Know when Gimp gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (zdi) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vuln.today AI 7.8 HIGH

File must be opened locally by the user (AV:L, UI:R); no prior privileges needed (PR:N); parsing is deterministic (AC:L); arbitrary code execution yields full CIA impact in user context (C:H/I:H/A:H, S:U).

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 7.8 HIGH

Primary rating from Vendor (zdi).

CVSS VectorVendor: zdi

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

DescriptionCVE.org

GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of HDR files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28618.

Executive ViewAI

Why It Matters

GIMP contains a heap-based buffer overflow in its HDR image parser (CVE-2026-2049) that allows arbitrary code execution when users open crafted files. Organizations with design, photography, or media teams face code execution risk via a common file format requiring only user interaction. Immediate file handling restrictions and close patch monitoring are required to protect user endpoints.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: restrict opening of HDR files from external/untrusted sources; run GIMP in sandboxed or containerized environments where operationally feasible; disable GIMP from processing HDR files in automated workflows; implement network-level restrictions on GIMP's ability to access restricted resources; maintain strict user awareness training on file source validation. Monitor vendor advisories daily for patch availability.

Threat Intelligence Overview

EPSS Score
0.1%
Top 82% exploitable
Social Media
3
Sightings
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Small
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Heap Overflow HIGH

A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

More in Gimp

View all
CVE-2012-2763 HIGH POC
7.5 Jul 12

Buffer overflow in the readstr_upto function in plug-ins/script-fu/tinyscheme/scheme.c in GIMP 2.6.12 and earlier, and p
CVE-2012-5576 HIGH POC
7.5 Dec 18

Multiple stack-based buffer overflows in file-xwd.c in the X Window Dump (XWD) plug-in in GIMP 2.8.2 allow remote attack
CVE-2017-17789 HIGH POC
7.8 Dec 20

In GIMP 2.8.22, there is a heap-based buffer overflow in read_channel_data in plug-ins/common/file-psp.c. Rated high sev
CVE-2012-3236 MEDIUM POC
4.3 Jul 12

fits-io.c in GIMP before 2.8.1 allows remote attackers to cause a denial of service (NULL pointer dereference and applic
CVE-2022-32990 MEDIUM POC
5.5 Jun 24

An issue in gimp_layer_invalidate_boundary of GNOME GIMP 2.10.30 allows attackers to trigger an unhandled exception via

CVE-2022-30067 MEDIUM POC
5.5 May 17

GIMP 2.10.30 and 2.99.10 are vulnerable to Buffer Overflow. Rated medium severity (CVSS 5.5), this vulnerability is no a
CVE-2018-12713 CRITICAL
9.1 Jun 24

GIMP through 2.10.2 makes g_get_tmp_dir calls to establish temporary filenames, which may result in a filename that alre
CVE-2025-5473 HIGH
8.8 Jun 06

Critical remote code execution vulnerability in GIMP's ICO file parser caused by an integer overflow (CWE-190) that lack
CVE-2026-2044 HIGH
8.8 Feb 20

Remote code execution in GIMP 3.0.6 allows attackers to run arbitrary code by tricking a user into opening a malicious P
CVE-2026-0797 HIGH
8.8 Feb 20

Remote code execution in GIMP 3.2.0-rc1 lets attackers run arbitrary code by tricking a user into opening a malicious IC
CVE-2016-4994 HIGH
7.8 Jul 12

Use-after-free vulnerability in the xcf_load_image function in app/xcf/xcf-load.c in GIMP allows remote attackers to cau
CVE-2026-18307 HIGH
7.8 Aug 20

Heap-based buffer overflow in GIMP's TIF file parser enables remote code execution when a user opens a crafted TIFF imag

Same weakness CWE-122 – Heap-based Buffer Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2023-27997 CRITICAL
9.8
CVE-2026-94127 CRITICAL POC
9.3
CVE-2025-25249 CRITICAL POC
9.8
CVE-2026-85880 HIGH POC
7.8
CVE-2025-24985 HIGH POC
7.8
CVE-2026-53362 HIGH POC
7.8
CVE-2025-21418 HIGH
7.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 SUSE Linux Enterprise Workstation Extension 15 SP7 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed
SUSE Linux Enterprise Server 12 SP5-LTSS Fixed
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected

References

Advisories & patches
ADVISORY https://gitlab.gnome.org/GNOME/gegl/-/issues/450 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-2049 ADVISORY https://vuldb.com/vuln/351344 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1479/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1481/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1496/ REF https://access.redhat.com/security/cve/CVE-2026-2049 REF https://bugzilla.redhat.com/show_bug.cgi?id=2487738 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2049.json REF https://www.zerodayinitiative.com/advisories/ZDI-26-214/

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy