CVE-2026-80101

The GIMP is an image composition and editing program, which can be used for creating logos and other graphics for Web pages. The GIMP offers many tools and filters, and provides a large image manipulation toolbox, including channel operations and layers, effects, subpixel imaging and antialiasing, and conversions, together with multilevel undo. The GIMP offers a scripting facility, but many of the included scripts rely on fonts that we cannot distribute.

Security Fix(es):

A vulnerability classified as critical has been found in GIMP (Image Processing Software). The issue is categorized as CWE-120 (Buffer Overflow). The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. This vulnerability impacts confidentiality, integrity, and availability.(CVE-2026-18307)

A heap-based buffer overflow vulnerability exists in the GIMP DDS (DirectDraw Surface) file parser. When a crafted DDS file declares a D3D9 pixel format but sets a lower bits-per-pixel (bpp) value in the header, the loader allocates an undersized heap buffer. Subsequent pixel data consumption at the real format's stride causes a write past the heap buffer boundary, leading to heap metadata corruption and potential code execution.(CVE-2026-42170)

A flaw was found in the file-pcx plugin in GIMP, affecting 32-bit builds only. When processing a PCX image file, the plugin calculates memory allocation sizes based on the image dimensions and the number of color planes. If a crafted file sets the number of planes to 4 alongside sufficiently large dimensions, the calculation exceeds the 32-bit integer limit and overflows, resulting in an undersized heap-based buffer allocation. This integer overflow issue results in a heap-based buffer overflow when the plugin subsequently writes image data into the undersized buffer, causing memory corruption, potentially leading to arbitrary code execution or a denial of service.(CVE-2026-78465)

A flaw was found in the file-pix (ESM) plugin in GIMP. When processing a specially crafted PIX image file, the plugin allocates a Variable-Length Array (VLA) on the stack without proper bounds checking, causing an unbounded stack allocation followed by a 21-byte stack over-read. This can result in a denial of service due to stack exhaustion and a limited information disclosure of stack memory contents into an intermediate file.(CVE-2026-78475)

A flaw was found in the file-xwd plugin in GIMP. When processing a specially crafted XWD image file, the plugin validates the image width and bytes-per-line parameters independently rather than ensuring their combined values are consistent with the allocated buffer size. This incorrect validation leads to improper bounds checking, causing a heap out-of-bounds read. This issue can result in an application crash, leading to a denial of service, or a limited information disclosure of heap memory contents into the produced image.(CVE-2026-80101)

The GIMP is an image composition and editing program, which can be used for creating logos and other graphics for Web pages. The GIMP offers many tools and filters, and provides a large image manipulation toolbox, including channel operations and layers, effects, subpixel imaging and antialiasing, and conversions, together with multilevel undo. The GIMP offers a scripting facility, but many of the included scripts rely on fonts that we cannot distribute.

Security Fix(es):

A vulnerability classified as critical has been found in GIMP (Image Processing Software). The issue is categorized as CWE-120 (Buffer Overflow). The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. This vulnerability impacts confidentiality, integrity, and availability.(CVE-2026-18307)

A flaw was found in GIMP's file format plugins, including those for PSD and PAA files. A remote attacker could exploit these vulnerabilities by tricking a user into opening a specially crafted image file. This could lead to unexpected application behavior or other potential security impacts without requiring further user interaction.(CVE-2026-59091)

A flaw was found in the file-pcx plugin in GIMP, affecting 32-bit builds only. When processing a PCX image file, the plugin calculates memory allocation sizes based on the image dimensions and the number of color planes. If a crafted file sets the number of planes to 4 alongside sufficiently large dimensions, the calculation exceeds the 32-bit integer limit and overflows, resulting in an undersized heap-based buffer allocation. This integer overflow issue results in a heap-based buffer overflow when the plugin subsequently writes image data into the undersized buffer, causing memory corruption, potentially leading to arbitrary code execution or a denial of service.(CVE-2026-78465)

A flaw was found in the file-pix (ESM) plugin in GIMP. When processing a specially crafted PIX image file, the plugin allocates a Variable-Length Array (VLA) on the stack without proper bounds checking, causing an unbounded stack allocation followed by a 21-byte stack over-read. This can result in a denial of service due to stack exhaustion and a limited information disclosure of stack memory contents into an intermediate file.(CVE-2026-78475)

A flaw was found in the Seattle FilmWorks plugin in GIMP. When processing a specially crafted SFW image file, the plugin allocates a Variable-Length Array (VLA) on the stack without integer overflow checks, causing an unbounded stack allocation. This issue leads to an application crash, resulting in a denial of service.(CVE-2026-79902)

A flaw was found in the file-xwd plugin in GIMP. When processing a specially crafted XWD image file, the plugin validates the image width and bytes-per-line parameters independently rather than ensuring their combined values are consistent with the allocated buffer size. This incorrect validation leads to improper bounds checking, causing a heap out-of-bounds read. This issue can result in an application crash, leading to a denial of service, or a limited information disclosure of heap memory contents into the produced image.(CVE-2026-80101)

A flaw was found in the file-xwd plugin in GIMP. When processing a specially crafted XWD image file, the plugin validates the image width and bytes-per-line parameters independently rather than ensuring their combined values are consistent with the allocated buffer size. This incorrect validation leads to improper bounds checking, causing a heap out-of-bounds read. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of heap memory contents into the produced image.

• CVE-2026-80101: size the XWD 1-bit scanline buffers on the number of bytes the decode loops actually read, ceil(width / 8), instead of trusting l_bytes_per_line alone, and zero-fill them; the upstream guard is re-authored because its own arithmetic is inoperative
• CVE-2026-82343: reject PSD files whose declared channel count is below the minimum required by the color mode, so the merged image is no longer read with more bytes per pixel than were allocated (upstream's channel_idx array enlargement is not applicable: that write path does not exist in 2.99.8)

• CVE-2026-80101: size the XWD 1-bit scanline buffers on the number of bytes the decode loops actually read, ceil(width / 8), instead of trusting l_bytes_per_line alone, and zero-fill them; the upstream guard is re-authored because its own arithmetic is inoperative
• CVE-2026-82343: reject PSD files whose declared channel count is below the minimum required by the color mode, so the merged image is no longer read with more bytes per pixel than were allocated (upstream's channel_idx array enlargement is not applicable: that write path does not exist in 2.99.8)

This update to v. 3.2.8 fixes several security issues.

These are all security issues fixed in the gimp-3.2.6-1.1 package on the GA media of openSUSE Tumbleweed.

This update for gimp fixes the following issues:

Changes in gimp:

• CVE-2026-78465: 32-bit integer overflow in PCX image memory calculations can cause undersized heap allocations (bsc#1277378)
• CVE-2026-78475: unbounded variable-length stack allocations in the PIX loader can cause stack exhaustion crashes and stack memory disclosures (bsc#1277380)
• CVE-2026-80101: independent header field validation in the XWD loader can cause heap out-of-bounds reads (bsc#1276911)

This update for gimp fixes the following issues:

Security issues fixed:

• CVE-2026-59088: denial of service via signed integer overflow in FLI file processing (bsc#1274837).
• CVE-2026-59090: arbitrary code execution in PSD plugin due to unsigned underflow (bsc#1274840).
• CVE-2026-66757: signed integer overflow in file-sgi causes the plugin to crash when RLE-compressed SGI images are processed (bsc#1273151).
• CVE-2026-78465: 32-bit integer overflow in PCX image memory calculations can cause undersized heap allocations (bsc#1277378).
• CVE-2026-80101: independent header field validation in the XWD loader can cause heap out-of-bounds reads (bsc#1276911).

Non security issues fixed:

• RLE-compressed SGI files are written with a bad offset table and 57 of 144 scanlines fail to decode, on the patched and the released build alike (bsc#1279838).
• XWD bytes-per-line guard can never fire, and load_xwd_f1_d24_b1() still allocates the unchecked header field (bsc#1279839).