Gimp
Monthly
Heap-based buffer overflow in GIMP's DirectDraw Surface (DDS) loader allows attackers to corrupt memory and potentially execute arbitrary code by convincing a user to open a crafted .dds image. The flaw affects GIMP as shipped in Red Hat Enterprise Linux 6, 7, 8, 9, and 10, and requires local file access plus user interaction (opening the malicious file) with no authentication required per the CVSS vector (PR:N). No public exploit code has been identified at time of analysis, and exploitation is limited to the privileges of the user running GIMP.
Heap-based buffer overflow in GIMP's file-psd import plugin allows a crafted PSD file to corrupt adjacent heap memory, causing an application crash or potentially arbitrary code execution when the user opens the file or when a thumbnail preview is generated for it. The root cause is an integer overflow (CWE-190) in the multiplication of values taken from an embedded JPEG header, which yields an undersized heap allocation that is subsequently overrun during image decoding and can be turned into a controlled memory write. The assessed vector (CVSS 3.1, 7.8 High, AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms this is a local, user-interaction-dependent flaw rather than a remotely reachable service bug, so exploitation requires delivering the malicious PSD to a machine where GIMP or an automatic PSD thumbnailer processes it; no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Heap-based buffer overflow in GIMP's Paint Shop Pro (PSP) file format loader allows arbitrary code execution when a victim opens a crafted PSP image file. The flaw stems from a size mismatch between the buffer allocated for a compressed selection channel and the actual decompressed output, triggering an out-of-bounds write on the heap. No public exploit has been identified at time of analysis, but the file-open trigger makes this a realistic phishing or drive-by vector against GIMP users on Red Hat Enterprise Linux 6-9.
Heap-based buffer overflow in GIMP's ICO file loader allows arbitrary code execution or application crash when a user opens a specially crafted ICO file containing an embedded PNG image. The root cause is an integer overflow during buffer size calculation (CWE-787, with CWE-190 as the precipitating cause), causing an undersized heap allocation that overflows when decoded pixel data is written. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
Remote code execution in GIMP 3.2.2 is achievable when a user opens a crafted APNG file, triggering an integer overflow before buffer allocation in the APNG parser (CWE-190). Disclosed by Zero Day Initiative as ZDI-CAN-29401/ZDI-26-462 and tracked as EUVD-2026-63458, the flaw yields full C/I/A compromise within the GIMP process. No active exploitation is confirmed (not listed in CISA KEV), but a fix commit is available on GNOME GitLab; no officially tagged patched release has been independently confirmed at time of analysis.
Remote code execution in GIMP 3.2.2 is achievable via a specially crafted TIF image file that triggers an integer overflow in the application's TIFF parser, causing an undersized heap allocation and subsequent memory corruption. An attacker who convinces a user to open a malicious file or visit an attacker-controlled page that delivers such a file can execute arbitrary code with the privileges of the victim's user account. No public exploit identified at time of analysis, though the ZDI origin (ZDI-26-461, formerly ZDI-CAN-29405) represents a technically verified, researcher-confirmed vulnerability with well-characterized root cause.
Heap-based buffer overflow in GIMP's TIF file parser enables remote code execution when a user opens a crafted TIFF image, affecting GIMP 3.2.2. The flaw stems from missing length validation before copying attacker-controlled data into a heap buffer (CWE-122), granting full code execution in the context of the GIMP process. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but a fix commit is available on the GNOME GitLab repository.
Remote code execution is possible in GIMP 3.2.2 through a maliciously crafted SGI image file, exploiting an integer overflow in the application's SGI file parser. An unauthenticated remote attacker can deliver the file via email or web and, upon the victim opening it, execute arbitrary code within the GIMP process context with the privileges of the logged-in user. No active exploitation has been confirmed (not in CISA KEV), though ZDI's coordinated public disclosure via ZDI-26-459 lowers the barrier to weaponization; an upstream patch commit exists but a formally tagged fixed release has not been independently confirmed.
Remote code execution in GIMP 3.2.2 is achievable by an attacker who can convince a target user to open a specially crafted TIF file, triggering an integer overflow during buffer allocation in the TIFF parser that leads to heap corruption and arbitrary code execution in the context of the current user process. Disclosed by the Zero Day Initiative under ZDI-26-458 (ZDI-CAN-29406), the flaw is rooted in missing validation of user-supplied size data before heap allocation. No public exploit has been identified at time of analysis and the vulnerability does not appear in the CISA KEV catalog; however, an upstream fix commit is available in the GIMP GitLab repository.
Remote code execution via maliciously crafted TIF files affects GIMP 3.2.2, allowing an attacker to execute arbitrary code in the context of the running GIMP process with full user-level privileges. The root cause is a CWE-190 integer overflow in the TIFF file parser where attacker-supplied image metadata bypasses size validation before a heap allocation, enabling memory corruption and code execution. Reported by Zero Day Initiative as ZDI-CAN-29403 and tracked under ENISA EUVD-2026-63453; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in GIMP 3.2.2's TIF file parser enables remote attackers to execute arbitrary code in the context of the current user process. Exploitation requires the target to open a specially crafted TIF image file, making this a socially-engineered attack delivered via malicious webpage or email attachment. Reported by the Zero Day Initiative (ZDI-26-456/ZDI-CAN-29399), a fix commit has been pushed to the upstream GNOME GitLab repository, though no independently confirmed patched release version is available at time of analysis.
Heap-based buffer overflow in GIMP's TIF file parser (CWE-122) enables remote code execution on affected installations when a user opens a crafted TIFF image. Confirmed affected version is GIMP 3.2.2 per EUVD-2026-63451, with the flaw originating from missing length validation before copying attacker-controlled data to a heap buffer. Discovered and reported by Zero Day Initiative (ZDI-26-455 / ZDI-CAN-29398); no public exploit or CISA KEV listing has been identified at time of analysis, though an upstream patch commit exists on GNOME GitLab.
Remote code execution in GIMP 3.2.2 is triggered when a victim opens a specially crafted PSD file, exploiting an integer overflow in the PSD parser that occurs before buffer allocation. Tracked by Zero Day Initiative as ZDI-CAN-29395 and rated CVSS 7.8, the flaw allows an unauthenticated remote attacker to execute arbitrary code within the GIMP process context after inducing the target to open a malicious file. No public exploit identified at time of analysis, and no active exploitation has been confirmed via CISA KEV.
Remote code execution in GIMP 3.2.2 is possible when a user opens a specially crafted HDR image file, with the underlying flaw residing in the GEGL image processing library that GIMP depends on. The integer overflow in HDR buffer size computation (CWE-190) produces an undersized heap allocation that an attacker can leverage to execute arbitrary code in the context of the victim's GIMP process. No public exploit code has been identified at time of analysis, and CISA KEV listing has not been confirmed; the ZDI advisory (ZDI-26-453) assigns this a High severity rating of CVSS 7.8.
Heap-based buffer overflows in GIMP's APNG and DDS image loaders let an attacker corrupt heap memory - and potentially achieve code execution - when a victim opens a specially crafted image file. The APNG path is triggered when the fcTL frame width exceeds the IHDR image width, so pixel data is written past the end of a heap allocation, while the DDS path involves a bits-per-pixel mismatch inside the load_layer() function. Exploitation is local and gated by user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R, 7.8 High), no public exploit code has been identified at time of analysis, and EPSS is very low at 0.13% (3rd percentile); Red Hat has shipped patched packages via RHSA-2026:73768 and RHSA-2026:50817.
Information disclosure and denial of service in GIMP's file-icns plugin allow local attackers to leak heap memory contents via a crafted ICNS image file. When processing a truncated mask resource, the plugin performs an out-of-bounds read, leaking heap data as alpha channel pixel values or crashing the application. User interaction is required to open the malicious file.
Arbitrary code execution in GIMP when opening a crafted FITS file due to an integer overflow in the file-fits plugin that leads to a heap buffer overflow. An attacker can achieve memory corruption and potentially execute arbitrary code with the user's privileges. No public exploit or active exploitation has been identified at time of analysis.
Memory corruption in GIMP's Paint Shop Pro (.psp) import parser lets an attacker crash the application or possibly execute code by persuading a victim to open a crafted PSP image file. The root cause is a double-free (CWE-415) in the read_layer_block() routine; exploitation requires local user interaction to open the file and results in per-user, client-side compromise rather than server-side or unattended exploitation. There is no public exploit identified at time of analysis, the SSVC decision framework rates exploitation as 'none' and automatable as 'no', and EPSS is low at 0.12% (2nd percentile), yet Red Hat tracks the defect across RHEL 6 through 9 and a vendor patch plus an upstream commit are available.
Arbitrary code execution in GIMP results from a heap-based buffer overflow in the HDR file parser, where attacker-controlled length data is copied into an undersized heap buffer without bounds validation. Any user who opens a maliciously crafted HDR image (or visits a page that delivers one) can be exploited, with code running in the context of the GIMP process. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Arbitrary code execution in GIMP via malicious HDR (High Dynamic Range) image files allows attackers to run code in the context of the user opening the file. The flaw is a heap-based buffer overflow (CWE-122) in the HDR parser, requiring the victim to open a crafted file or visit a malicious page that delivers one. No public exploit identified at time of analysis, but the vulnerability was reported through ZDI (ZDI-CAN-28618) indicating verified researcher analysis.
Integer overflow in GIMP XPM file parser enables remote code execution when processing malicious XPM image files. Affects GIMP installations across platforms. Attackers can execute arbitrary code in victim's process context by delivering crafted XPM files via social engineering or drive-by downloads. Vulnerability requires user interaction (opening malicious file). CVSS 7.8 (High severity). No public exploit identified at time of analysis. Upstream patch committed to GIMP repository; vendor-released version not independently confirmed.
Heap-based buffer overflow in GIMP's PSP (Paint Shop Pro) file parser enables remote code execution when processing malicious PSP image files. Unauthenticated attackers can execute arbitrary code with user privileges by convincing targets to open crafted PSP files. CVSS 7.8 (High) reflects local attack vector requiring user interaction. No public exploit identified at time of analysis. Vulnerability tracked as ZDI-CAN-28874 by Zero Day Initiative.
Heap-based buffer overflow in GIMP's JP2 image parser enables unauthenticated remote code execution when users open crafted JPEG 2000 files. The vulnerability stems from insufficient validation of user-supplied data length before copying to heap memory, allowing attackers to execute arbitrary code with user privileges. Exploitation requires social engineering to convince targets to open malicious JP2 files. No public exploit identified at time of analysis.
Remote code execution in GIMP via integer overflow during ANI (animated cursor) file parsing allows unauthenticated attackers to execute arbitrary code with user privileges when malicious ANI files are opened. Exploitation requires user interaction (opening crafted file or visiting attacker-controlled page). Insufficient validation of user-supplied data triggers integer overflow before buffer allocation, enabling memory corruption. No public exploit identified at time of analysis. CVSS 7.8 (High) reflects local attack vector with no privilege requirements.
Integer overflow in GIMP PSD file parser enables remote code execution when users open malicious PSD files. Affects GIMP installations across platforms. Exploitation requires user interaction (opening crafted file). Attacker achieves arbitrary code execution in application context with high confidentiality, integrity, and availability impact. Publicly available exploit code exists. Insufficient validation of user-supplied data during buffer allocation causes overflow, allowing memory corruption and code execution.
GIMP is vulnerable to out-of-bounds memory write during XWD file parsing due to insufficient input validation, enabling arbitrary code execution when a user opens a malicious image file. This high-severity vulnerability (CVSS 7.8) affects local attackers who can craft specially crafted XWD files to corrupt memory and execute code with the privileges of the GIMP process. No patch is currently available.
Remote code execution in GIMP through heap buffer overflow during ICNS file parsing allows attackers to execute arbitrary code when a user opens a malicious image file. The vulnerability stems from insufficient validation of user-supplied data lengths before copying to heap memory, requiring only user interaction to trigger. A patch is available for affected installations.
Out-of-bounds write in GIMP 3.0.6's XWD (X Window Dump) image file parser allows remote attackers to execute arbitrary code in the context of the user running GIMP, provided the victim is lured into opening a malicious XWD file or visiting a page that delivers one. The CVSS 3.1 vector (AV:L/UI:R) shows this is not a remote-network attack but a user-interaction-driven file-parsing flaw, scored 7.3 (High). There is no public exploit identified at time of analysis, and EPSS is very low (0.08%, 23rd percentile), consistent with an attack that depends on social engineering rather than mass automation.
Remote code execution in GIMP 3.0.6 allows attackers to run arbitrary code by tricking a user into opening a malicious PGM (Portable Gray Map) image file or visiting a page that delivers one. The PGM parser accesses memory before it is properly initialized (CWE-908), letting a crafted file corrupt program state and hijack execution in the context of the current user. Discovered and reported via Trend Micro's Zero Day Initiative (ZDI-26-118 / ZDI-CAN-28158); no public exploit identified at time of analysis and EPSS exploitation probability is low (0.06%, 20th percentile).
Remote code execution in GIMP 3.2.0-rc1 lets attackers run arbitrary code by tricking a user into opening a malicious ICO image file or visiting a page that delivers one. The flaw is a heap-based buffer overflow in the ICO file parser caused by missing length validation before a copy operation, and it executes code in the context of the GIMP process. No public exploit has been identified at time of analysis, and EPSS estimates exploitation probability at just 0.06% (19th percentile), consistent with a user-interaction-gated client-side bug rather than mass-exploited infrastructure.
Buffer overflow in the readstr_upto function in plug-ins/script-fu/tinyscheme/scheme.c in GIMP 2.6.12 and earlier, and possibly 2.6.13, allows remote attackers to execute arbitrary code via a long. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 88.8%.
Denial of service and limited memory disclosure in GIMP's Bohemia Interactive (PAA) texture importer, triggered when a user opens or previews a specially crafted .paa file through the affected plug-in. An integer overflow in the image-dimension calculation during decompression causes an undersized heap buffer to be allocated, and the subsequent out-of-bounds read crashes the plug-in process and may expose fragments of heap memory (CVSS 3.1 base 6.1, AV:L/PR:N/UI:R, C:L/A:H). The attack requires the victim to deliberately load the malicious file locally, so there is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV) - this is assessed as a moderate-severity, low-priority issue in practice.
Opening a specially crafted XCF file in GIMP can crash the application through a NULL pointer dereference in the XCF loader's handling of image-simulation-intent and image-simulation-bpc parasites that carry zero-size data. The issue is confined to a denial of service of the GIMP process - there is no code execution, privilege escalation, or data exposure - and exploitation requires local access plus the victim manually opening an attacker-supplied file (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, 5.5). No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (not in CISA KEV), though Red Hat tracks the affected GIMP packages shipped in RHEL 6 through RHEL 10; this is a genuine but low-priority issue.
Heap-based buffer overflow in GIMP's 'Hot' color filter plug-in allows a crafted, extremely large image to corrupt heap memory when the filter is invoked, giving an attacker the ability to crash the plug-in and potentially achieve code execution within the running user's session (CWE-119). The flaw is reachable only locally and requires the victim to open an attacker-supplied image with dimensions so large that the width * height allocation arithmetic overflows 32-bit integers, then actively run the Hot filter on it - hence the assessed vector AV:L/AC:H/PR:N/UI:R with high integrity and availability impact but no confidentiality impact. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score provided, so this is a targeted, social-engineering-dependent client-side issue rather than an automatable, mass-exploitation threat. Red Hat hosts the primary advisory (access.redhat.com/security/cve/CVE-2026-106067) with tracking in Bugzilla 2547461, and GIMP packages across Red Hat Enterprise Linux 6 through 10 are enumerated as affected via CPE.
Exporting an oversized image through GIMP's raw data export plug-in can under-allocate a heap buffer and cause an out-of-bounds write on the heap, with the failure originating in an integer overflow in the g_malloc() size computation (width × height × bytes-per-pixel). Per the CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H), exploitation is local-only, requires the victim to actively start the export, requires no privileges (PR:N), and is gated by high attack complexity because the image dimensions must be crafted so the size arithmetic wraps; the assessment rates confidentiality impact as none and integrity/availability impact as high. No public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis, and the EPSS-style signals provided are consistent with a moderate-priority rather than critical issue, since the plug-in is standard GIMP functionality but the trigger depends on user-driven export of deliberately large images.
Heap-based buffer overflow in GIMP's PCX export plug-in allows a local attacker to corrupt memory when a user opens or creates an image with extremely large width and height and exports it to PCX format. The flaw, tracked as CVE-2026-106065 with a CVSS score of 6.3 (AV:L/AC:H/PR:N/UI:R), stems from 32-bit integer overflow in the width*height size calculation while GEGL operations use the full extent. Affected GIMP packages ship with Red Hat Enterprise Linux 6 through 10; no public exploit code or active exploitation has been identified at time of analysis.
Integer overflow in GIMP's GIF export plug-in leads to a heap-based buffer overflow when a user exports an image whose width and height are large enough to wrap the 32-bit pixel-buffer size calculation, resulting in an out-of-bounds write that can crash the application or corrupt memory. Affected software is the GIMP package as distributed in Red Hat Enterprise Linux 6, 7, 8, 9 and 10, and exploitation is local (AV:L) with high attack complexity (AC:H) and mandatory user interaction (UI:R) while requiring no privileges (PR:N) - the attacker must induce a user to export an image with extreme dimensions. No public exploit identified at time of analysis, and the independent assessment rates this a moderate-severity, genuinely low-urgency issue rather than a top priority.
Out-of-bounds heap reads in GIMP's XMC (X cursor) thumbnail loader can crash the application or corrupt process memory when a victim opens a crafted XMC file, or when thumbnail generation is triggered for one by a file manager. The root cause is an integer overflow: the loader sizes a pixel buffer using width * height computed in 32-bit signed arithmetic, so an oversized product wraps to a small allocation that a later GEGL buffer read then indexes using the unwrapped dimensions. Exploitation is strictly local and user-interaction dependent (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, 5.5), with no network attack surface and no confidentiality or integrity impact; no public exploit code and no confirmed active exploitation were identified at time of analysis, and Red Hat tracks the issue across RHEL 6 through 10.
Integer overflow leading to a heap-based buffer overflow in GIMP's DICOM export plug-in allows a local user to corrupt memory when exporting an image whose width and height are large enough that the 32-bit width × height × bytes-per-pixel product wraps and undersizes the heap allocation. Exploitation requires the victim to initiate the export and involves a crafted image with extremely large dimensions, so the attack is local (AV:L) and user-interaction dependent (UI:R), with high attack complexity (AC:H); the assessed CVSS is 6.3 with high integrity and availability impact but no confidentiality impact. No public exploit code has been identified and there is no indication of confirmed active exploitation (CISA KEV), and no vendor-released patch version is identified in the available data.
Opening a crafted uncompressed DDS image in GIMP triggers a one-byte heap out-of-bounds read in the file-dds plug-in, which can crash the plug-in process. The flaw requires a local user to open the malicious file (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L), and the crash is non-deterministic because it only occurs when the byte past the pixel buffer lands on an inaccessible memory page; no information disclosure or code execution has been demonstrated. No public exploit code has been identified at time of analysis, and while downstream tracking covers Red Hat Enterprise Linux 6 through 10, the availability-only impact keeps real-world risk low and the 'RCE', 'Buffer Overflow' and 'Information Disclosure' tags attached to this record are not supported by the assessed vector.
Out-of-bounds heap read in GIMP's TIM image loader is triggered when a user opens a crafted 4bpp TIM image that is promoted to an RGBA layer, causing the file-tim plug-in to allocate an undersized row buffer and then process it with the larger RGBA row size. The result is disclosure of adjacent heap memory into the decoded image and a possible plug-in crash, with exploitation requiring local access and victim user interaction (CVSS 4.4, CWE-125). No public exploit is identified at time of analysis, and impact is bounded to partial confidentiality loss and availability loss rather than code execution.
Stack-based denial of service in GIMP's Seattle FilmWorks (SFW) image plugin crashes the application when a crafted SFW file triggers an unbounded variable-length array allocation on the stack. The flaw affects all GIMP versions per the GNOME CPE string and is confirmed across Red Hat Enterprise Linux 6 through 9. An attacker who can deliver a malicious SFW file to a user can reliably crash the GIMP process with no code execution or data exposure; no public exploit has been identified at time of analysis.
An integer overflow in GIMP's file-sgi plugin, triggered by a crafted RLE-compressed SGI image, causes denial of service by crashing the plugin. The vulnerability affects GIMP versions with the file-sgi plugin and requires a user to open a malicious image file. No public exploit or active exploitation is known at this time; the issue is being tracked by GNOME and Red Hat.
GIMP PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. [CVSS 7.8 HIGH]
MacOS version of GIMP bundles a Python interpreter that inherits the Transparency, Consent, and Control (TCC) permissions granted by the user to the main application bundle. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. No vendor patch available.
A flaw was found in GIMP. An integer overflow vulnerability exists in the GIMP "Despeckle" plug-in. The issue occurs due to unchecked multiplication of image dimensions, such as width, height, and bytes-per-pixel (img_bpp), which can result in allocating insufficient memory and subsequently performing out-of-bounds writes. This issue could lead to heap corruption, a potential denial of service (DoS), or arbitrary code execution in certain scenarios.
Critical remote code execution vulnerability in GIMP's ICO file parser caused by an integer overflow (CWE-190) that lacks proper input validation. This vulnerability affects GIMP users who open malicious ICO files or visit attacker-controlled pages serving malicious images, allowing arbitrary code execution with user privileges. The CVSS score of 8.8 reflects high severity with network-accessible attack vector and required user interaction; exploitation status and active weaponization details require cross-reference with KEV/EPSS data.
GIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
GIMP XWD File Parsing Integer Overflow Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
An issue in gimp_layer_invalidate_boundary of GNOME GIMP 2.10.30 allows attackers to trigger an unhandled exception via a crafted XCF file, causing a Denial of Service (DoS). Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
GIMP 2.10.30 and 2.99.10 are vulnerable to Buffer Overflow. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
load_cache in GEGL before 0.4.34 allows shell expansion when a pathname in a constructed command line is not escaped or filtered. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.
GIMP through 2.10.2 makes g_get_tmp_dir calls to establish temporary filenames, which may result in a filename that already exists, as demonstrated by the gimp_write_and_read_file function in. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
In GIMP 2.8.22, there is a heap-based buffer overflow in read_channel_data in plug-ins/common/file-psp.c. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In GIMP 2.8.22, there is a stack-based buffer over-read in xcf_load_stream in app/xcf/xcf.c when there is no '\0' character after the version string. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In GIMP 2.8.22, there is a heap-based buffer over-read in read_creator_block in plug-ins/common/file-psp.c. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.
In GIMP 2.8.22, there is a heap-based buffer over-read in ReadImage in plug-ins/common/file-tga.c (related to bgr2rgb.part.1) via an unexpected bits-per-pixel value for an RGBA image. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In GIMP 2.8.22, there is a heap-based buffer overflow in the fli_read_brun function in plug-ins/file-fli/fli.c. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In GIMP 2.8.22, there is a heap-based buffer over-read in load_image in plug-ins/common/file-gbr.c in the gbr import parser, related to mishandling of UTF-8 data. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Use-after-free vulnerability in the xcf_load_image function in app/xcf/xcf-load.c in GIMP allows remote attackers to cause a denial of service (program crash) or possibly execute arbitrary code via a. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
Heap-based buffer overflow in the read_xwd_cols function in file-xwd.c in the X Window Dump (XWD) plug-in in GIMP 2.6.9 and earlier allows remote attackers to cause a denial of service (crash) and. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. No vendor patch available.
Integer overflow in the load_image function in file-xwd.c in the X Window Dump (XWD) plug-in in GIMP 2.6.9 and earlier, when used with glib before 2.24, allows remote attackers to cause a denial of. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. No vendor patch available.
Multiple stack-based buffer overflows in file-xwd.c in the X Window Dump (XWD) plug-in in GIMP 2.8.2 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
The scriptfu network server in GIMP 2.6 does not require authentication, which allows remote attackers to execute arbitrary commands via the python-fu-eval command. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. No vendor patch available.
Integer overflow in the ReadImage function in plug-ins/common/file-gif-load.c in the GIF image format plug-in in GIMP 2.8.x and earlier allows remote attackers to cause a denial of service. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. No vendor patch available.
Heap-based buffer overflow in the KiSS CEL file format plug-in in GIMP 2.8.x and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted KiSS. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. No vendor patch available.
Integer overflow in plug-ins/common/psd.c in the Adobe Photoshop PSD plugin in GIMP 2.2.13 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. No vendor patch available.
fits-io.c in GIMP before 2.8.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a malformed XTENSION header of a .fit file, as demonstrated. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Heap-based buffer overflow in GIMP's DirectDraw Surface (DDS) loader allows attackers to corrupt memory and potentially execute arbitrary code by convincing a user to open a crafted .dds image. The flaw affects GIMP as shipped in Red Hat Enterprise Linux 6, 7, 8, 9, and 10, and requires local file access plus user interaction (opening the malicious file) with no authentication required per the CVSS vector (PR:N). No public exploit code has been identified at time of analysis, and exploitation is limited to the privileges of the user running GIMP.
Heap-based buffer overflow in GIMP's file-psd import plugin allows a crafted PSD file to corrupt adjacent heap memory, causing an application crash or potentially arbitrary code execution when the user opens the file or when a thumbnail preview is generated for it. The root cause is an integer overflow (CWE-190) in the multiplication of values taken from an embedded JPEG header, which yields an undersized heap allocation that is subsequently overrun during image decoding and can be turned into a controlled memory write. The assessed vector (CVSS 3.1, 7.8 High, AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms this is a local, user-interaction-dependent flaw rather than a remotely reachable service bug, so exploitation requires delivering the malicious PSD to a machine where GIMP or an automatic PSD thumbnailer processes it; no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Heap-based buffer overflow in GIMP's Paint Shop Pro (PSP) file format loader allows arbitrary code execution when a victim opens a crafted PSP image file. The flaw stems from a size mismatch between the buffer allocated for a compressed selection channel and the actual decompressed output, triggering an out-of-bounds write on the heap. No public exploit has been identified at time of analysis, but the file-open trigger makes this a realistic phishing or drive-by vector against GIMP users on Red Hat Enterprise Linux 6-9.
Heap-based buffer overflow in GIMP's ICO file loader allows arbitrary code execution or application crash when a user opens a specially crafted ICO file containing an embedded PNG image. The root cause is an integer overflow during buffer size calculation (CWE-787, with CWE-190 as the precipitating cause), causing an undersized heap allocation that overflows when decoded pixel data is written. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
Remote code execution in GIMP 3.2.2 is achievable when a user opens a crafted APNG file, triggering an integer overflow before buffer allocation in the APNG parser (CWE-190). Disclosed by Zero Day Initiative as ZDI-CAN-29401/ZDI-26-462 and tracked as EUVD-2026-63458, the flaw yields full C/I/A compromise within the GIMP process. No active exploitation is confirmed (not listed in CISA KEV), but a fix commit is available on GNOME GitLab; no officially tagged patched release has been independently confirmed at time of analysis.
Remote code execution in GIMP 3.2.2 is achievable via a specially crafted TIF image file that triggers an integer overflow in the application's TIFF parser, causing an undersized heap allocation and subsequent memory corruption. An attacker who convinces a user to open a malicious file or visit an attacker-controlled page that delivers such a file can execute arbitrary code with the privileges of the victim's user account. No public exploit identified at time of analysis, though the ZDI origin (ZDI-26-461, formerly ZDI-CAN-29405) represents a technically verified, researcher-confirmed vulnerability with well-characterized root cause.
Heap-based buffer overflow in GIMP's TIF file parser enables remote code execution when a user opens a crafted TIFF image, affecting GIMP 3.2.2. The flaw stems from missing length validation before copying attacker-controlled data into a heap buffer (CWE-122), granting full code execution in the context of the GIMP process. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but a fix commit is available on the GNOME GitLab repository.
Remote code execution is possible in GIMP 3.2.2 through a maliciously crafted SGI image file, exploiting an integer overflow in the application's SGI file parser. An unauthenticated remote attacker can deliver the file via email or web and, upon the victim opening it, execute arbitrary code within the GIMP process context with the privileges of the logged-in user. No active exploitation has been confirmed (not in CISA KEV), though ZDI's coordinated public disclosure via ZDI-26-459 lowers the barrier to weaponization; an upstream patch commit exists but a formally tagged fixed release has not been independently confirmed.
Remote code execution in GIMP 3.2.2 is achievable by an attacker who can convince a target user to open a specially crafted TIF file, triggering an integer overflow during buffer allocation in the TIFF parser that leads to heap corruption and arbitrary code execution in the context of the current user process. Disclosed by the Zero Day Initiative under ZDI-26-458 (ZDI-CAN-29406), the flaw is rooted in missing validation of user-supplied size data before heap allocation. No public exploit has been identified at time of analysis and the vulnerability does not appear in the CISA KEV catalog; however, an upstream fix commit is available in the GIMP GitLab repository.
Remote code execution via maliciously crafted TIF files affects GIMP 3.2.2, allowing an attacker to execute arbitrary code in the context of the running GIMP process with full user-level privileges. The root cause is a CWE-190 integer overflow in the TIFF file parser where attacker-supplied image metadata bypasses size validation before a heap allocation, enabling memory corruption and code execution. Reported by Zero Day Initiative as ZDI-CAN-29403 and tracked under ENISA EUVD-2026-63453; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in GIMP 3.2.2's TIF file parser enables remote attackers to execute arbitrary code in the context of the current user process. Exploitation requires the target to open a specially crafted TIF image file, making this a socially-engineered attack delivered via malicious webpage or email attachment. Reported by the Zero Day Initiative (ZDI-26-456/ZDI-CAN-29399), a fix commit has been pushed to the upstream GNOME GitLab repository, though no independently confirmed patched release version is available at time of analysis.
Heap-based buffer overflow in GIMP's TIF file parser (CWE-122) enables remote code execution on affected installations when a user opens a crafted TIFF image. Confirmed affected version is GIMP 3.2.2 per EUVD-2026-63451, with the flaw originating from missing length validation before copying attacker-controlled data to a heap buffer. Discovered and reported by Zero Day Initiative (ZDI-26-455 / ZDI-CAN-29398); no public exploit or CISA KEV listing has been identified at time of analysis, though an upstream patch commit exists on GNOME GitLab.
Remote code execution in GIMP 3.2.2 is triggered when a victim opens a specially crafted PSD file, exploiting an integer overflow in the PSD parser that occurs before buffer allocation. Tracked by Zero Day Initiative as ZDI-CAN-29395 and rated CVSS 7.8, the flaw allows an unauthenticated remote attacker to execute arbitrary code within the GIMP process context after inducing the target to open a malicious file. No public exploit identified at time of analysis, and no active exploitation has been confirmed via CISA KEV.
Remote code execution in GIMP 3.2.2 is possible when a user opens a specially crafted HDR image file, with the underlying flaw residing in the GEGL image processing library that GIMP depends on. The integer overflow in HDR buffer size computation (CWE-190) produces an undersized heap allocation that an attacker can leverage to execute arbitrary code in the context of the victim's GIMP process. No public exploit code has been identified at time of analysis, and CISA KEV listing has not been confirmed; the ZDI advisory (ZDI-26-453) assigns this a High severity rating of CVSS 7.8.
Heap-based buffer overflows in GIMP's APNG and DDS image loaders let an attacker corrupt heap memory - and potentially achieve code execution - when a victim opens a specially crafted image file. The APNG path is triggered when the fcTL frame width exceeds the IHDR image width, so pixel data is written past the end of a heap allocation, while the DDS path involves a bits-per-pixel mismatch inside the load_layer() function. Exploitation is local and gated by user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R, 7.8 High), no public exploit code has been identified at time of analysis, and EPSS is very low at 0.13% (3rd percentile); Red Hat has shipped patched packages via RHSA-2026:73768 and RHSA-2026:50817.
Information disclosure and denial of service in GIMP's file-icns plugin allow local attackers to leak heap memory contents via a crafted ICNS image file. When processing a truncated mask resource, the plugin performs an out-of-bounds read, leaking heap data as alpha channel pixel values or crashing the application. User interaction is required to open the malicious file.
Arbitrary code execution in GIMP when opening a crafted FITS file due to an integer overflow in the file-fits plugin that leads to a heap buffer overflow. An attacker can achieve memory corruption and potentially execute arbitrary code with the user's privileges. No public exploit or active exploitation has been identified at time of analysis.
Memory corruption in GIMP's Paint Shop Pro (.psp) import parser lets an attacker crash the application or possibly execute code by persuading a victim to open a crafted PSP image file. The root cause is a double-free (CWE-415) in the read_layer_block() routine; exploitation requires local user interaction to open the file and results in per-user, client-side compromise rather than server-side or unattended exploitation. There is no public exploit identified at time of analysis, the SSVC decision framework rates exploitation as 'none' and automatable as 'no', and EPSS is low at 0.12% (2nd percentile), yet Red Hat tracks the defect across RHEL 6 through 9 and a vendor patch plus an upstream commit are available.
Arbitrary code execution in GIMP results from a heap-based buffer overflow in the HDR file parser, where attacker-controlled length data is copied into an undersized heap buffer without bounds validation. Any user who opens a maliciously crafted HDR image (or visits a page that delivers one) can be exploited, with code running in the context of the GIMP process. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Arbitrary code execution in GIMP via malicious HDR (High Dynamic Range) image files allows attackers to run code in the context of the user opening the file. The flaw is a heap-based buffer overflow (CWE-122) in the HDR parser, requiring the victim to open a crafted file or visit a malicious page that delivers one. No public exploit identified at time of analysis, but the vulnerability was reported through ZDI (ZDI-CAN-28618) indicating verified researcher analysis.
Integer overflow in GIMP XPM file parser enables remote code execution when processing malicious XPM image files. Affects GIMP installations across platforms. Attackers can execute arbitrary code in victim's process context by delivering crafted XPM files via social engineering or drive-by downloads. Vulnerability requires user interaction (opening malicious file). CVSS 7.8 (High severity). No public exploit identified at time of analysis. Upstream patch committed to GIMP repository; vendor-released version not independently confirmed.
Heap-based buffer overflow in GIMP's PSP (Paint Shop Pro) file parser enables remote code execution when processing malicious PSP image files. Unauthenticated attackers can execute arbitrary code with user privileges by convincing targets to open crafted PSP files. CVSS 7.8 (High) reflects local attack vector requiring user interaction. No public exploit identified at time of analysis. Vulnerability tracked as ZDI-CAN-28874 by Zero Day Initiative.
Heap-based buffer overflow in GIMP's JP2 image parser enables unauthenticated remote code execution when users open crafted JPEG 2000 files. The vulnerability stems from insufficient validation of user-supplied data length before copying to heap memory, allowing attackers to execute arbitrary code with user privileges. Exploitation requires social engineering to convince targets to open malicious JP2 files. No public exploit identified at time of analysis.
Remote code execution in GIMP via integer overflow during ANI (animated cursor) file parsing allows unauthenticated attackers to execute arbitrary code with user privileges when malicious ANI files are opened. Exploitation requires user interaction (opening crafted file or visiting attacker-controlled page). Insufficient validation of user-supplied data triggers integer overflow before buffer allocation, enabling memory corruption. No public exploit identified at time of analysis. CVSS 7.8 (High) reflects local attack vector with no privilege requirements.
Integer overflow in GIMP PSD file parser enables remote code execution when users open malicious PSD files. Affects GIMP installations across platforms. Exploitation requires user interaction (opening crafted file). Attacker achieves arbitrary code execution in application context with high confidentiality, integrity, and availability impact. Publicly available exploit code exists. Insufficient validation of user-supplied data during buffer allocation causes overflow, allowing memory corruption and code execution.
GIMP is vulnerable to out-of-bounds memory write during XWD file parsing due to insufficient input validation, enabling arbitrary code execution when a user opens a malicious image file. This high-severity vulnerability (CVSS 7.8) affects local attackers who can craft specially crafted XWD files to corrupt memory and execute code with the privileges of the GIMP process. No patch is currently available.
Remote code execution in GIMP through heap buffer overflow during ICNS file parsing allows attackers to execute arbitrary code when a user opens a malicious image file. The vulnerability stems from insufficient validation of user-supplied data lengths before copying to heap memory, requiring only user interaction to trigger. A patch is available for affected installations.
Out-of-bounds write in GIMP 3.0.6's XWD (X Window Dump) image file parser allows remote attackers to execute arbitrary code in the context of the user running GIMP, provided the victim is lured into opening a malicious XWD file or visiting a page that delivers one. The CVSS 3.1 vector (AV:L/UI:R) shows this is not a remote-network attack but a user-interaction-driven file-parsing flaw, scored 7.3 (High). There is no public exploit identified at time of analysis, and EPSS is very low (0.08%, 23rd percentile), consistent with an attack that depends on social engineering rather than mass automation.
Remote code execution in GIMP 3.0.6 allows attackers to run arbitrary code by tricking a user into opening a malicious PGM (Portable Gray Map) image file or visiting a page that delivers one. The PGM parser accesses memory before it is properly initialized (CWE-908), letting a crafted file corrupt program state and hijack execution in the context of the current user. Discovered and reported via Trend Micro's Zero Day Initiative (ZDI-26-118 / ZDI-CAN-28158); no public exploit identified at time of analysis and EPSS exploitation probability is low (0.06%, 20th percentile).
Remote code execution in GIMP 3.2.0-rc1 lets attackers run arbitrary code by tricking a user into opening a malicious ICO image file or visiting a page that delivers one. The flaw is a heap-based buffer overflow in the ICO file parser caused by missing length validation before a copy operation, and it executes code in the context of the GIMP process. No public exploit has been identified at time of analysis, and EPSS estimates exploitation probability at just 0.06% (19th percentile), consistent with a user-interaction-gated client-side bug rather than mass-exploited infrastructure.
Buffer overflow in the readstr_upto function in plug-ins/script-fu/tinyscheme/scheme.c in GIMP 2.6.12 and earlier, and possibly 2.6.13, allows remote attackers to execute arbitrary code via a long. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 88.8%.
Denial of service and limited memory disclosure in GIMP's Bohemia Interactive (PAA) texture importer, triggered when a user opens or previews a specially crafted .paa file through the affected plug-in. An integer overflow in the image-dimension calculation during decompression causes an undersized heap buffer to be allocated, and the subsequent out-of-bounds read crashes the plug-in process and may expose fragments of heap memory (CVSS 3.1 base 6.1, AV:L/PR:N/UI:R, C:L/A:H). The attack requires the victim to deliberately load the malicious file locally, so there is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV) - this is assessed as a moderate-severity, low-priority issue in practice.
Opening a specially crafted XCF file in GIMP can crash the application through a NULL pointer dereference in the XCF loader's handling of image-simulation-intent and image-simulation-bpc parasites that carry zero-size data. The issue is confined to a denial of service of the GIMP process - there is no code execution, privilege escalation, or data exposure - and exploitation requires local access plus the victim manually opening an attacker-supplied file (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, 5.5). No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (not in CISA KEV), though Red Hat tracks the affected GIMP packages shipped in RHEL 6 through RHEL 10; this is a genuine but low-priority issue.
Heap-based buffer overflow in GIMP's 'Hot' color filter plug-in allows a crafted, extremely large image to corrupt heap memory when the filter is invoked, giving an attacker the ability to crash the plug-in and potentially achieve code execution within the running user's session (CWE-119). The flaw is reachable only locally and requires the victim to open an attacker-supplied image with dimensions so large that the width * height allocation arithmetic overflows 32-bit integers, then actively run the Hot filter on it - hence the assessed vector AV:L/AC:H/PR:N/UI:R with high integrity and availability impact but no confidentiality impact. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score provided, so this is a targeted, social-engineering-dependent client-side issue rather than an automatable, mass-exploitation threat. Red Hat hosts the primary advisory (access.redhat.com/security/cve/CVE-2026-106067) with tracking in Bugzilla 2547461, and GIMP packages across Red Hat Enterprise Linux 6 through 10 are enumerated as affected via CPE.
Exporting an oversized image through GIMP's raw data export plug-in can under-allocate a heap buffer and cause an out-of-bounds write on the heap, with the failure originating in an integer overflow in the g_malloc() size computation (width × height × bytes-per-pixel). Per the CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H), exploitation is local-only, requires the victim to actively start the export, requires no privileges (PR:N), and is gated by high attack complexity because the image dimensions must be crafted so the size arithmetic wraps; the assessment rates confidentiality impact as none and integrity/availability impact as high. No public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis, and the EPSS-style signals provided are consistent with a moderate-priority rather than critical issue, since the plug-in is standard GIMP functionality but the trigger depends on user-driven export of deliberately large images.
Heap-based buffer overflow in GIMP's PCX export plug-in allows a local attacker to corrupt memory when a user opens or creates an image with extremely large width and height and exports it to PCX format. The flaw, tracked as CVE-2026-106065 with a CVSS score of 6.3 (AV:L/AC:H/PR:N/UI:R), stems from 32-bit integer overflow in the width*height size calculation while GEGL operations use the full extent. Affected GIMP packages ship with Red Hat Enterprise Linux 6 through 10; no public exploit code or active exploitation has been identified at time of analysis.
Integer overflow in GIMP's GIF export plug-in leads to a heap-based buffer overflow when a user exports an image whose width and height are large enough to wrap the 32-bit pixel-buffer size calculation, resulting in an out-of-bounds write that can crash the application or corrupt memory. Affected software is the GIMP package as distributed in Red Hat Enterprise Linux 6, 7, 8, 9 and 10, and exploitation is local (AV:L) with high attack complexity (AC:H) and mandatory user interaction (UI:R) while requiring no privileges (PR:N) - the attacker must induce a user to export an image with extreme dimensions. No public exploit identified at time of analysis, and the independent assessment rates this a moderate-severity, genuinely low-urgency issue rather than a top priority.
Out-of-bounds heap reads in GIMP's XMC (X cursor) thumbnail loader can crash the application or corrupt process memory when a victim opens a crafted XMC file, or when thumbnail generation is triggered for one by a file manager. The root cause is an integer overflow: the loader sizes a pixel buffer using width * height computed in 32-bit signed arithmetic, so an oversized product wraps to a small allocation that a later GEGL buffer read then indexes using the unwrapped dimensions. Exploitation is strictly local and user-interaction dependent (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, 5.5), with no network attack surface and no confidentiality or integrity impact; no public exploit code and no confirmed active exploitation were identified at time of analysis, and Red Hat tracks the issue across RHEL 6 through 10.
Integer overflow leading to a heap-based buffer overflow in GIMP's DICOM export plug-in allows a local user to corrupt memory when exporting an image whose width and height are large enough that the 32-bit width × height × bytes-per-pixel product wraps and undersizes the heap allocation. Exploitation requires the victim to initiate the export and involves a crafted image with extremely large dimensions, so the attack is local (AV:L) and user-interaction dependent (UI:R), with high attack complexity (AC:H); the assessed CVSS is 6.3 with high integrity and availability impact but no confidentiality impact. No public exploit code has been identified and there is no indication of confirmed active exploitation (CISA KEV), and no vendor-released patch version is identified in the available data.
Opening a crafted uncompressed DDS image in GIMP triggers a one-byte heap out-of-bounds read in the file-dds plug-in, which can crash the plug-in process. The flaw requires a local user to open the malicious file (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L), and the crash is non-deterministic because it only occurs when the byte past the pixel buffer lands on an inaccessible memory page; no information disclosure or code execution has been demonstrated. No public exploit code has been identified at time of analysis, and while downstream tracking covers Red Hat Enterprise Linux 6 through 10, the availability-only impact keeps real-world risk low and the 'RCE', 'Buffer Overflow' and 'Information Disclosure' tags attached to this record are not supported by the assessed vector.
Out-of-bounds heap read in GIMP's TIM image loader is triggered when a user opens a crafted 4bpp TIM image that is promoted to an RGBA layer, causing the file-tim plug-in to allocate an undersized row buffer and then process it with the larger RGBA row size. The result is disclosure of adjacent heap memory into the decoded image and a possible plug-in crash, with exploitation requiring local access and victim user interaction (CVSS 4.4, CWE-125). No public exploit is identified at time of analysis, and impact is bounded to partial confidentiality loss and availability loss rather than code execution.
Stack-based denial of service in GIMP's Seattle FilmWorks (SFW) image plugin crashes the application when a crafted SFW file triggers an unbounded variable-length array allocation on the stack. The flaw affects all GIMP versions per the GNOME CPE string and is confirmed across Red Hat Enterprise Linux 6 through 9. An attacker who can deliver a malicious SFW file to a user can reliably crash the GIMP process with no code execution or data exposure; no public exploit has been identified at time of analysis.
An integer overflow in GIMP's file-sgi plugin, triggered by a crafted RLE-compressed SGI image, causes denial of service by crashing the plugin. The vulnerability affects GIMP versions with the file-sgi plugin and requires a user to open a malicious image file. No public exploit or active exploitation is known at this time; the issue is being tracked by GNOME and Red Hat.
GIMP PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. [CVSS 7.8 HIGH]
MacOS version of GIMP bundles a Python interpreter that inherits the Transparency, Consent, and Control (TCC) permissions granted by the user to the main application bundle. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. No vendor patch available.
A flaw was found in GIMP. An integer overflow vulnerability exists in the GIMP "Despeckle" plug-in. The issue occurs due to unchecked multiplication of image dimensions, such as width, height, and bytes-per-pixel (img_bpp), which can result in allocating insufficient memory and subsequently performing out-of-bounds writes. This issue could lead to heap corruption, a potential denial of service (DoS), or arbitrary code execution in certain scenarios.
Critical remote code execution vulnerability in GIMP's ICO file parser caused by an integer overflow (CWE-190) that lacks proper input validation. This vulnerability affects GIMP users who open malicious ICO files or visit attacker-controlled pages serving malicious images, allowing arbitrary code execution with user privileges. The CVSS score of 8.8 reflects high severity with network-accessible attack vector and required user interaction; exploitation status and active weaponization details require cross-reference with KEV/EPSS data.
GIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
GIMP XWD File Parsing Integer Overflow Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
An issue in gimp_layer_invalidate_boundary of GNOME GIMP 2.10.30 allows attackers to trigger an unhandled exception via a crafted XCF file, causing a Denial of Service (DoS). Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
GIMP 2.10.30 and 2.99.10 are vulnerable to Buffer Overflow. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
load_cache in GEGL before 0.4.34 allows shell expansion when a pathname in a constructed command line is not escaped or filtered. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.
GIMP through 2.10.2 makes g_get_tmp_dir calls to establish temporary filenames, which may result in a filename that already exists, as demonstrated by the gimp_write_and_read_file function in. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
In GIMP 2.8.22, there is a heap-based buffer overflow in read_channel_data in plug-ins/common/file-psp.c. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In GIMP 2.8.22, there is a stack-based buffer over-read in xcf_load_stream in app/xcf/xcf.c when there is no '\0' character after the version string. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In GIMP 2.8.22, there is a heap-based buffer over-read in read_creator_block in plug-ins/common/file-psp.c. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.
In GIMP 2.8.22, there is a heap-based buffer over-read in ReadImage in plug-ins/common/file-tga.c (related to bgr2rgb.part.1) via an unexpected bits-per-pixel value for an RGBA image. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In GIMP 2.8.22, there is a heap-based buffer overflow in the fli_read_brun function in plug-ins/file-fli/fli.c. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In GIMP 2.8.22, there is a heap-based buffer over-read in load_image in plug-ins/common/file-gbr.c in the gbr import parser, related to mishandling of UTF-8 data. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Use-after-free vulnerability in the xcf_load_image function in app/xcf/xcf-load.c in GIMP allows remote attackers to cause a denial of service (program crash) or possibly execute arbitrary code via a. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
Heap-based buffer overflow in the read_xwd_cols function in file-xwd.c in the X Window Dump (XWD) plug-in in GIMP 2.6.9 and earlier allows remote attackers to cause a denial of service (crash) and. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. No vendor patch available.
Integer overflow in the load_image function in file-xwd.c in the X Window Dump (XWD) plug-in in GIMP 2.6.9 and earlier, when used with glib before 2.24, allows remote attackers to cause a denial of. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. No vendor patch available.
Multiple stack-based buffer overflows in file-xwd.c in the X Window Dump (XWD) plug-in in GIMP 2.8.2 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
The scriptfu network server in GIMP 2.6 does not require authentication, which allows remote attackers to execute arbitrary commands via the python-fu-eval command. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. No vendor patch available.
Integer overflow in the ReadImage function in plug-ins/common/file-gif-load.c in the GIF image format plug-in in GIMP 2.8.x and earlier allows remote attackers to cause a denial of service. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. No vendor patch available.
Heap-based buffer overflow in the KiSS CEL file format plug-in in GIMP 2.8.x and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted KiSS. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. No vendor patch available.
Integer overflow in plug-ins/common/psd.c in the Adobe Photoshop PSD plugin in GIMP 2.2.13 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. No vendor patch available.
fits-io.c in GIMP before 2.8.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a malformed XTENSION header of a .fit file, as demonstrated. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.