CVE-2026-18307

The GIMP is an image composition and editing program, which can be used for creating logos and other graphics for Web pages. The GIMP offers many tools and filters, and provides a large image manipulation toolbox, including channel operations and layers, effects, subpixel imaging and antialiasing, and conversions, together with multilevel undo. The GIMP offers a scripting facility, but many of the included scripts rely on fonts that we cannot distribute.

Security Fix(es):

A vulnerability classified as critical has been found in GIMP (Image Processing Software). The issue is categorized as CWE-120 (Buffer Overflow). The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. This vulnerability impacts confidentiality, integrity, and availability.(CVE-2026-18307)

A heap-based buffer overflow vulnerability exists in the GIMP DDS (DirectDraw Surface) file parser. When a crafted DDS file declares a D3D9 pixel format but sets a lower bits-per-pixel (bpp) value in the header, the loader allocates an undersized heap buffer. Subsequent pixel data consumption at the real format's stride causes a write past the heap buffer boundary, leading to heap metadata corruption and potential code execution.(CVE-2026-42170)

A flaw was found in the file-pcx plugin in GIMP, affecting 32-bit builds only. When processing a PCX image file, the plugin calculates memory allocation sizes based on the image dimensions and the number of color planes. If a crafted file sets the number of planes to 4 alongside sufficiently large dimensions, the calculation exceeds the 32-bit integer limit and overflows, resulting in an undersized heap-based buffer allocation. This integer overflow issue results in a heap-based buffer overflow when the plugin subsequently writes image data into the undersized buffer, causing memory corruption, potentially leading to arbitrary code execution or a denial of service.(CVE-2026-78465)

A flaw was found in the file-pix (ESM) plugin in GIMP. When processing a specially crafted PIX image file, the plugin allocates a Variable-Length Array (VLA) on the stack without proper bounds checking, causing an unbounded stack allocation followed by a 21-byte stack over-read. This can result in a denial of service due to stack exhaustion and a limited information disclosure of stack memory contents into an intermediate file.(CVE-2026-78475)

A flaw was found in the file-xwd plugin in GIMP. When processing a specially crafted XWD image file, the plugin validates the image width and bytes-per-line parameters independently rather than ensuring their combined values are consistent with the allocated buffer size. This incorrect validation leads to improper bounds checking, causing a heap out-of-bounds read. This issue can result in an application crash, leading to a denial of service, or a limited information disclosure of heap memory contents into the produced image.(CVE-2026-80101)

The GIMP is an image composition and editing program, which can be used for creating logos and other graphics for Web pages. The GIMP offers many tools and filters, and provides a large image manipulation toolbox, including channel operations and layers, effects, subpixel imaging and antialiasing, and conversions, together with multilevel undo. The GIMP offers a scripting facility, but many of the included scripts rely on fonts that we cannot distribute.

Security Fix(es):

A vulnerability classified as critical has been found in GIMP (Image Processing Software). The issue is categorized as CWE-120 (Buffer Overflow). The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. This vulnerability impacts confidentiality, integrity, and availability.(CVE-2026-18307)

A heap-based buffer overflow vulnerability exists in the GIMP DDS (DirectDraw Surface) file parser. When a crafted DDS file declares a D3D9 pixel format but sets a lower bits-per-pixel (bpp) value in the header, the loader allocates an undersized heap buffer. Subsequent pixel data consumption at the real format's stride causes a write past the heap buffer boundary, leading to heap metadata corruption and potential code execution.(CVE-2026-42170)

A flaw was found in the file-pcx plugin in GIMP, affecting 32-bit builds only. When processing a PCX image file, the plugin calculates memory allocation sizes based on the image dimensions and the number of color planes. If a crafted file sets the number of planes to 4 alongside sufficiently large dimensions, the calculation exceeds the 32-bit integer limit and overflows, resulting in an undersized heap-based buffer allocation. This integer overflow issue results in a heap-based buffer overflow when the plugin subsequently writes image data into the undersized buffer, causing memory corruption, potentially leading to arbitrary code execution or a denial of service.(CVE-2026-78465)

A flaw was found in the file-pix (ESM) plugin in GIMP. When processing a specially crafted PIX image file, the plugin allocates a Variable-Length Array (VLA) on the stack without proper bounds checking, causing an unbounded stack allocation followed by a 21-byte stack over-read. This can result in a denial of service due to stack exhaustion and a limited information disclosure of stack memory contents into an intermediate file.(CVE-2026-78475)

A flaw was found in the file-xwd plugin in GIMP. When processing a specially crafted XWD image file, the plugin validates the image width and bytes-per-line parameters independently rather than ensuring their combined values are consistent with the allocated buffer size. This incorrect validation leads to improper bounds checking, causing a heap out-of-bounds read. This issue can result in an application crash, leading to a denial of service, or a limited information disclosure of heap memory contents into the produced image.(CVE-2026-80101)

The GIMP is an image composition and editing program, which can be used for creating logos and other graphics for Web pages. The GIMP offers many tools and filters, and provides a large image manipulation toolbox, including channel operations and layers, effects, subpixel imaging and antialiasing, and conversions, together with multilevel undo. The GIMP offers a scripting facility, but many of the included scripts rely on fonts that we cannot distribute.

Security Fix(es):

A vulnerability classified as critical has been found in GIMP (Image Processing Software). The issue is categorized as CWE-120 (Buffer Overflow). The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. This vulnerability impacts confidentiality, integrity, and availability.(CVE-2026-18307)

A flaw was found in GIMP's file format plugins, including those for PSD and PAA files. A remote attacker could exploit these vulnerabilities by tricking a user into opening a specially crafted image file. This could lead to unexpected application behavior or other potential security impacts without requiring further user interaction.(CVE-2026-59091)

A flaw was found in the file-pcx plugin in GIMP, affecting 32-bit builds only. When processing a PCX image file, the plugin calculates memory allocation sizes based on the image dimensions and the number of color planes. If a crafted file sets the number of planes to 4 alongside sufficiently large dimensions, the calculation exceeds the 32-bit integer limit and overflows, resulting in an undersized heap-based buffer allocation. This integer overflow issue results in a heap-based buffer overflow when the plugin subsequently writes image data into the undersized buffer, causing memory corruption, potentially leading to arbitrary code execution or a denial of service.(CVE-2026-78465)

A flaw was found in the file-pix (ESM) plugin in GIMP. When processing a specially crafted PIX image file, the plugin allocates a Variable-Length Array (VLA) on the stack without proper bounds checking, causing an unbounded stack allocation followed by a 21-byte stack over-read. This can result in a denial of service due to stack exhaustion and a limited information disclosure of stack memory contents into an intermediate file.(CVE-2026-78475)

A flaw was found in the Seattle FilmWorks plugin in GIMP. When processing a specially crafted SFW image file, the plugin allocates a Variable-Length Array (VLA) on the stack without integer overflow checks, causing an unbounded stack allocation. This issue leads to an application crash, resulting in a denial of service.(CVE-2026-79902)

A flaw was found in the file-xwd plugin in GIMP. When processing a specially crafted XWD image file, the plugin validates the image width and bytes-per-line parameters independently rather than ensuring their combined values are consistent with the allocated buffer size. This incorrect validation leads to improper bounds checking, causing a heap out-of-bounds read. This issue can result in an application crash, leading to a denial of service, or a limited information disclosure of heap memory contents into the produced image.(CVE-2026-80101)

The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.

Security Fix(es):

• gimp: gimp: Stack buffer overflow in pnmscanner_gettoken() (CVE-2026-58380)

• gimp: integer overflow in file-fits plugin causes a heap-based buffer overflow on crafted FITS images (CVE-2026-66758)

• gimp: GIMP: Arbitrary code execution via crafted TIF file parsing (CVE-2026-18304)

• gimp: GIMP: Remote code execution via PSD file parsing integer overflow (CVE-2026-18301)

• gimp: GIMP: Remote Code Execution via TIF file parsing integer overflow (CVE-2026-18305)

• gimp: GIMP: Remote code execution via TIF file parsing vulnerability (CVE-2026-18303)

• gimp: GIMP: Remote Code Execution via SGI File Parsing Integer Overflow (CVE-2026-18306)

• gimp: GIMP: Remote code execution via TIF file parsing heap-based buffer overflow (CVE-2026-18307)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

GIMP TIF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29404.

The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.

Security Fix(es):

• gimp: GIMP: Arbitrary code execution in PSD plugin due to unsigned underflow (CVE-2026-59090)
• gimp: GIMP: Arbitrary code execution via crafted TIF file parsing (CVE-2026-18304)
• gimp: GIMP: Remote code execution via PSD file parsing integer overflow (CVE-2026-18301)
• gimp: GIMP: Remote Code Execution via TIF File Parsing Integer Overflow (CVE-2026-18308)
• gimp: GIMP: Remote code execution via TIF file parsing heap-based buffer overflow (CVE-2026-18302)
• gimp: GIMP: Remote Code Execution via TIF file parsing integer overflow (CVE-2026-18305)
• gimp: GIMP: Remote code execution via TIF file parsing vulnerability (CVE-2026-18303)
• gimp: GIMP: Remote Code Execution via SGI File Parsing Integer Overflow (CVE-2026-18306)
• gimp: GIMP: Remote code execution via TIF file parsing heap-based buffer overflow (CVE-2026-18307)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.

Security Fix(es):

• gimp: gimp: Stack buffer overflow in pnmscanner_gettoken() (CVE-2026-58380)
• gimp: integer overflow in file-fits plugin causes a heap-based buffer overflow on crafted FITS images (CVE-2026-66758)
• gimp: GIMP: Arbitrary code execution via crafted TIF file parsing (CVE-2026-18304)
• gimp: GIMP: Remote code execution via PSD file parsing integer overflow (CVE-2026-18301)
• gimp: GIMP: Remote Code Execution via TIF file parsing integer overflow (CVE-2026-18305)
• gimp: GIMP: Remote code execution via TIF file parsing vulnerability (CVE-2026-18303)
• gimp: GIMP: Remote Code Execution via SGI File Parsing Integer Overflow (CVE-2026-18306)
• gimp: GIMP: Remote code execution via TIF file parsing heap-based buffer overflow (CVE-2026-18307)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• CVE-2026-18301: validate the PSD channel data allocation with a checked multiplication and fail cleanly instead of overflowing the raw_data buffer
• CVE-2026-18302: pass the correct row stride to convert_int2uint() when loading separate-plane TIFFs so the conversion cannot write past the end of the heap-allocated row buffer
• CVE-2026-18303: reject indexed TIFFs whose bit depth implies a color map larger than 256 entries instead of overrunning the 768-byte stack cmap
• CVE-2026-18304: compute the TIFF upscale tile area as gsize and use a checked allocation so an integer overflow cannot undersize bw_buffer
• CVE-2026-18305: use checked multiplications for the TIFF RGBA image allocation instead of an overflowing width times height product
• CVE-2026-18306: reject SGI files whose bits-per-pixel is outside the supported range of 1 to 2 and cast the SGI row pointer arithmetic to gsize so an integer overflow cannot lead to an out-of-bounds write
• CVE-2026-18307: derive the TIFF bytes-per-pixel consistency check from the source babl format so a samples-per-pixel below the photometric setting cannot undercount the buffer size, and size the contiguous tile buffer with checked multiplications instead of trusting TIFFTileSize()

• CVE-2026-18301: validate the PSD channel data allocation with a checked multiplication and fail cleanly instead of overflowing the raw_data buffer
• CVE-2026-18302: pass the correct row stride to convert_int2uint() when loading separate-plane TIFFs so the conversion cannot write past the end of the heap-allocated row buffer
• CVE-2026-18303: reject indexed TIFFs whose bit depth implies a color map larger than 256 entries instead of overrunning the 768-byte stack cmap
• CVE-2026-18304: compute the TIFF upscale tile area as gsize and use a checked allocation so an integer overflow cannot undersize bw_buffer
• CVE-2026-18305: use checked multiplications for the TIFF RGBA image allocation instead of an overflowing width times height product
• CVE-2026-18306: reject SGI files whose bits-per-pixel is outside the supported range of 1 to 2 and cast the SGI row pointer arithmetic to gsize so an integer overflow cannot lead to an out-of-bounds write
• CVE-2026-18307: derive the TIFF bytes-per-pixel consistency check from the source babl format so a samples-per-pixel below the photometric setting cannot undercount the buffer size, and size the contiguous tile buffer with checked multiplications instead of trusting TIFFTileSize()

This update for gimp fixes the following issues:

Changes in gimp:

• CVE-2026-18304: GIMP TIF File Parsing Integer Overflow Remote Code Execution Vulnerability (bsc#1276233)
• CVE-2026-18301: GIMP PSD File Parsing Integer Overflow Remote Code Execution Vulnerability (bsc#1276230)
• CVE-2026-18307: GIMP TIF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (bsc#1276236)
• CVE-2026-18303: GIMP TIF File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (bsc#1276232)
• CVE-2026-18308: GIMP TIF File Parsing Integer Overflow Remote Code Execution Vulnerability (bsc#1276237)
• CVE-2026-18306: GIMP SGI File Parsing Integer Overflow Remote Code Execution Vulnerability (bsc#1276235)
• CVE-2026-18305: GIMP TIF File Parsing Integer Overflow Remote Code Execution Vulnerability (bsc#1276234)
• CVE-2026-18302: GIMP TIF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (bsc#1276231)
• CVE-2026-90947: out-of-bounds write in the lighting effects plugin when processing a crafted preset file due to improper validation of the number of light sources (bsc#1280511)
• CVE-2026-90948: When processing an ICO file containing an embedded PNG image, an integer overflow can occur during the calculation of the required buffer size (bsc#1280512)
• CVE-2026-92248: When generating a thumbnail preview for a specially crafted PSD (Photoshop Document) image file, an integer overflow occurs during the multiplication of values from an embedded JPEG header (bsc#1280739)

This update for gimp fixes the following issues:

• CVE-2026-18301: Vulnerability Report at read_channel_data (bsc#1276230).
• CVE-2026-18302: TIF File Parsing Heap-based Buffer Overflow (bsc#1276231).
• CVE-2026-18303: TIF File Parsing Stack-based Buffer Overflow (bsc#1276232).
• CVE-2026-18304: TIF File Parsing Integer Overflow Remote Code Execution Vulnerability (bsc#1276233).
• CVE-2026-18305: TIF File Parsing Integer Overflow Remote Code Execution Vulnerability (bsc#1276234).
• CVE-2026-18306: SGI File Parsing Integer Overflow Remote Code Execution Vulnerability (bsc#1276235).
• CVE-2026-18307: File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (bsc#1276236).
• CVE-2026-90947: out-of-bounds write in the lighting effects plugin when processing a crafted preset file due to improper validation of the number of light sources (bsc#1280511).
• CVE-2026-90948: heap buffer overflow in the ICO loader when processing ICO files with embedded PNG images due to an integer overflow during calculation of buffer sizes (bsc#1280512).
• CVE-2026-92248: integer overflow when generating a thumbnail preview for a PSD file can lead to a heap buffer overflow (bsc#1280739).