Skip to main content

GIMP EUVDEUVD-2026-49405

| CVE-2026-66759 HIGH
Out-of-bounds Read (CWE-125)
2026-07-27 secalert@redhat.com GHSA-2gmh-5658-rrq3
7.1
CVSS 3.1 · Vendor: redhat
Share

Severity by source

Vendor (redhat) PRIMARY
7.1 HIGH
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
vuln.today AI
7.1 HIGH

Local file-based attack with no privileges needed, user must open crafted file; heap leak and crash impact.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:R/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
6.1 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Red Hat
7.1 MEDIUM
qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 27, 2026 - 19:31 vuln.today
CVE Published
Jul 27, 2026 - 19:17 nvd
HIGH 7.1

DescriptionCVE.org

A flaw was found in the file-icns plugin in GIMP. When applying a decompressed mask during ICNS image processing, the plugin reads from the mask data buffer without verifying if the cursor exceeds the allocated resource size. If a crafted file contains a truncated mask resource, the icns_decompress function continues reading past the bounds of the buffer. This out-of-bounds read vulnerability results in information disclosure of heap contents, where memory contents are leaked as alpha channel pixel values, or a crash leading to a denial of service if unmapped memory is accessed.

AnalysisAI

Information disclosure and denial of service in GIMP's file-icns plugin allow local attackers to leak heap memory contents via a crafted ICNS image file. When processing a truncated mask resource, the plugin performs an out-of-bounds read, leaking heap data as alpha channel pixel values or crashing the application. User interaction is required to open the malicious file.

Technical ContextAI

The vulnerability resides in the file-icns plugin's icns_decompress function, which processes ICNS (Apple Icon Image) files. During mask decompression, the plugin fails to validate a cursor against the allocated buffer size before reading data. This classic CWE-125 out-of-bounds read occurs on the heap, resulting in exposure of adjacent memory. CPE data is not provided, but the affected component is GIMP with the ICNS plugin enabled. No specific version range is confirmed, though Red Hat's advisory suggests the flaw exists in GIMP as shipped in their distributions.

RemediationAI

No vendor-released patch is confirmed from the provided references. The upstream GitLab issue likely contains a fix, but no specific version number is available. As a workaround, disable or remove the file-icns plugin to prevent exploitation, though this will break support for ICNS icons. Alternatively, users should avoid opening ICNS files from untrusted sources. Monitor the GIMP security announcements and Red Hat advisory for official updates.

CVE-2019-11043 CRITICAL POC
9.8 Oct 28

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it

CVE-2014-6271 CRITICAL POC
9.8 Sep 24

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which

CVE-2021-40438 CRITICAL POC
9.0 Sep 16

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.4.4

CVE-2014-7169 CRITICAL POC
9.8 Sep 25

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of

CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour

CVE-2016-5195 HIGH POC
7.0 Nov 10

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev

CVE-2023-4911 HIGH POC
7.8 Oct 03

Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected

CVE-2017-1000253 HIGH POC
7.8 Oct 05

Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb7

CVE-2017-5645 CRITICAL POC
9.8 Apr 17

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events

CVE-2015-0240 CRITICAL POC
10.0 Feb 24

The Netlogon server implementation in smbd in Samba 3.5.x and 3.6.x before 3.6.25, 4.0.x before 4.0.25, 4.1.x before 4.1

CVE-2016-6662 CRITICAL POC
9.8 Sep 20

Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.2

CVE-2025-32463 CRITICAL POC
9.3 Jun 30

Sudo before 1.9.17p1 contains a local root escalation vulnerability (CVE-2025-32463, CVSS 9.3) through the --chroot opti

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Leap 16.0 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Not-Affected
SUSE Linux Enterprise Server 15 SP7 Not-Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Not-Affected

Share

EUVD-2026-49405 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy