CVE-2026-90948
Gimp: gimp: heap-based buffer overflow in ico loader via integer overflow in embedded png dimensions
7.8 HighFix available
CVE-2026-90948 is a high vulnerability (CVSS 7.8) in Red Hat Enterprise Linux 6, published September 14, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.23%, the 13th percentile. Fixed in gimp 3.0.4-3+deb13u11.
- Severity
- 7.8 HighCVSS 3.1, CVE List
- Exploit chance
- 0.23%EPSS, 13th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
3.0.4-3+deb13u11gimp +91 more
Description
A flaw was found in GIMP's ICO file loader. When processing an ICO file containing an embedded PNG image, an integer overflow can occur during the calculation of the required buffer size. This leads to an undersized buffer being allocated, causing a heap-based buffer overflow when the decoded pixel data is written. A remote attacker could exploit this by crafting a malicious ICO file, which, when opened, could lead to arbitrary code execution or a crash.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
0.23%Unchanged since Sep 15, 2026
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gimpAlmaLinux:9 From an advisory covering 4 CVEs | before 2:3.0.4-4.el9_8.14 | 2:3.0.4-4.el9_8.14 |
gimp-libsAlmaLinux:9 From an advisory covering 4 CVEs | before 2:3.0.4-4.el9_8.14 | 2:3.0.4-4.el9_8.14 |
gimpAlmaLinux:8 From an advisory covering 4 CVEs | before 2:2.8.22-26.module_el8.10.0+4306+69430cd5.9 | 2:2.8.22-26.module_el8.10.0+4306+69430cd5.9 |
gimp-develAlmaLinux:8 From an advisory covering 4 CVEs | before 2:2.8.22-26.module_el8.10.0+4306+69430cd5.9 | 2:2.8.22-26.module_el8.10.0+4306+69430cd5.9 |
gimp-devel-toolsAlmaLinux:8 From an advisory covering 4 CVEs | before 2:2.8.22-26.module_el8.10.0+4306+69430cd5.9 | 2:2.8.22-26.module_el8.10.0+4306+69430cd5.9 |
gimp-libsAlmaLinux:8 From an advisory covering 4 CVEs | before 2:2.8.22-26.module_el8.10.0+4306+69430cd5.9 | 2:2.8.22-26.module_el8.10.0+4306+69430cd5.9 |
pygobject2AlmaLinux:8 From an advisory covering 4 CVEs | before 2.28.7-5.module_el8.10.0+4267+35168c80 | 2.28.7-5.module_el8.10.0+4267+35168c80 |
pygobject2-codegenAlmaLinux:8 From an advisory covering 4 CVEs | before 2.28.7-5.module_el8.10.0+4267+35168c80 | 2.28.7-5.module_el8.10.0+4267+35168c80 |
pygobject2-develAlmaLinux:8 From an advisory covering 4 CVEs | before 2.28.7-5.module_el8.10.0+4267+35168c80 | 2.28.7-5.module_el8.10.0+4267+35168c80 |
pygobject2-docAlmaLinux:8 From an advisory covering 4 CVEs | before 2.28.7-5.module_el8.10.0+4267+35168c80 | 2.28.7-5.module_el8.10.0+4267+35168c80 |
Show 82 moreShow less
| Package | Affected | Fixed |
|---|---|---|
pygtk2AlmaLinux:8 From an advisory covering 4 CVEs | before 2.24.0-25.module_el8.9.0+3725+d1441900 | 2.24.0-25.module_el8.9.0+3725+d1441900 |
pygtk2-codegenAlmaLinux:8 From an advisory covering 4 CVEs | before 2.24.0-25.module_el8.9.0+3725+d1441900 | 2.24.0-25.module_el8.9.0+3725+d1441900 |
pygtk2-develAlmaLinux:8 From an advisory covering 4 CVEs | before 2.24.0-25.module_el8.9.0+3725+d1441900 | 2.24.0-25.module_el8.9.0+3725+d1441900 |
pygtk2-docAlmaLinux:8 From an advisory covering 4 CVEs | before 2.24.0-25.module_el8.9.0+3725+d1441900 | 2.24.0-25.module_el8.9.0+3725+d1441900 |
python2-cairoAlmaLinux:8 From an advisory covering 4 CVEs | before 1.16.3-7.module_el8.10.0+4267+35168c80 | 1.16.3-7.module_el8.10.0+4267+35168c80 |
python2-cairo-develAlmaLinux:8 From an advisory covering 4 CVEs | before 1.16.3-7.module_el8.10.0+4267+35168c80 | 1.16.3-7.module_el8.10.0+4267+35168c80 |
gimpTuxCare:AlmaLinux:9.6 From an advisory covering 4 CVEs | before 2:2.99.8-4.el9_6.2.tuxcare.els22 | 2:2.99.8-4.el9_6.2.tuxcare.els22 |
gimp-develTuxCare:AlmaLinux:9.6 From an advisory covering 4 CVEs | before 2:2.99.8-4.el9_6.2.tuxcare.els22 | 2:2.99.8-4.el9_6.2.tuxcare.els22 |
gimp-devel-toolsTuxCare:AlmaLinux:9.6 From an advisory covering 4 CVEs | before 2:2.99.8-4.el9_6.2.tuxcare.els22 | 2:2.99.8-4.el9_6.2.tuxcare.els22 |
gimp-libsTuxCare:AlmaLinux:9.6 From an advisory covering 4 CVEs | before 2:2.99.8-4.el9_6.2.tuxcare.els22 | 2:2.99.8-4.el9_6.2.tuxcare.els22 |
gimpTuxCare:AlmaLinux:9.2 From an advisory covering 4 CVEs | before 2:2.99.8-4.el9.2.tuxcare.els22 | 2:2.99.8-4.el9.2.tuxcare.els22 |
gimp-develTuxCare:AlmaLinux:9.2 From an advisory covering 4 CVEs | before 2:2.99.8-4.el9.2.tuxcare.els22 | 2:2.99.8-4.el9.2.tuxcare.els22 |
gimp-devel-toolsTuxCare:AlmaLinux:9.2 From an advisory covering 4 CVEs | before 2:2.99.8-4.el9.2.tuxcare.els22 | 2:2.99.8-4.el9.2.tuxcare.els22 |
gimp-libsTuxCare:AlmaLinux:9.2 From an advisory covering 4 CVEs | before 2:2.99.8-4.el9.2.tuxcare.els22 | 2:2.99.8-4.el9.2.tuxcare.els22 |
gimpDebian:12 | All versions, plus listed versions 2.10.34-12.10.34-1+deb12u12.10.34-1+deb12u102.10.34-1+deb12u22.10.34-1+deb12u3 Show 45 moreShow less2.10.34-1+deb12u42.10.34-1+deb12u52.10.34-1+deb12u62.10.34-1+deb12u72.10.34-1+deb12u82.10.34-1+deb12u92.10.36-12.10.36-22.10.36-32.10.38-12.10.38-22.99.10-12.99.12-12.99.12-22.99.14-12.99.14-22.99.16-12.99.16-22.99.18-13.0.0-13.0.0-23.0.0~RC1-13.0.0~RC1-33.0.0~RC1-43.0.0~RC2-13.0.0~RC3-13.0.2-13.0.2-23.0.2-33.0.2-3.13.0.4-13.0.4-23.0.4-33.0.4-43.0.4-53.0.4-63.0.4-6.13.0.4-6.23.0.6-13.2.0-13.2.0~RC2-13.2.0~RC2-23.2.0~RC2-33.2.0~RC2-3.13.2.0~RC2-3.2 | None known |
gimpDebian:13 | before 3.0.4-3+deb13u11, plus listed versions 3.0.4-33.0.4-3+deb13u13.0.4-3+deb13u103.0.4-3+deb13u23.0.4-3+deb13u3 Show 6 moreShow less3.0.4-3+deb13u43.0.4-3+deb13u53.0.4-3+deb13u63.0.4-3+deb13u73.0.4-3+deb13u83.0.4-3+deb13u9 | 3.0.4-3+deb13u11 |
gimpDebian:14 | before 3.2.6-1, plus listed versions 3.0.4-33.0.4-43.0.4-53.0.4-63.0.4-6.1 Show 14 moreShow less3.0.4-6.23.0.6-13.2.0-13.2.0~RC2-13.2.0~RC2-23.2.0~RC2-33.2.0~RC2-3.13.2.0~RC2-3.23.2.0~RC2-3.33.2.0~RC3-13.2.2-13.2.4-13.2.4-23.2.4-3 | 3.2.6-1 |
gimpMageia:10 From an advisory covering 28 CVEs | before 3.2.8-1.mga10 | 3.2.8-1.mga10 |
gimpRed Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs | before 2:3.0.4-4.el9_8.14 | 2:3.0.4-4.el9_8.14 |
gimp-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs | before 2:3.0.4-4.el9_8.14 | 2:3.0.4-4.el9_8.14 |
gimp-debugsourceRed Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs | before 2:3.0.4-4.el9_8.14 | 2:3.0.4-4.el9_8.14 |
gimp-devel-tools-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs | before 2:3.0.4-4.el9_8.14 | 2:3.0.4-4.el9_8.14 |
gimp-libsRed Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs | before 2:3.0.4-4.el9_8.14 | 2:3.0.4-4.el9_8.14 |
gimp-libs-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs | before 2:3.0.4-4.el9_8.14 | 2:3.0.4-4.el9_8.14 |
gimpRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs | before 2:2.8.22-26.module+el8.10.0+25091+9b86bd7c.9 | 2:2.8.22-26.module+el8.10.0+25091+9b86bd7c.9 |
gimp-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs | before 2:2.8.22-26.module+el8.10.0+25091+9b86bd7c.9 | 2:2.8.22-26.module+el8.10.0+25091+9b86bd7c.9 |
gimp-debugsourceRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs | before 2:2.8.22-26.module+el8.10.0+25091+9b86bd7c.9 | 2:2.8.22-26.module+el8.10.0+25091+9b86bd7c.9 |
gimp-develRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs | before 2:2.8.22-26.module+el8.10.0+25091+9b86bd7c.9 | 2:2.8.22-26.module+el8.10.0+25091+9b86bd7c.9 |
gimp-devel-toolsRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs | before 2:2.8.22-26.module+el8.10.0+25091+9b86bd7c.9 | 2:2.8.22-26.module+el8.10.0+25091+9b86bd7c.9 |
gimp-devel-tools-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs | before 2:2.8.22-26.module+el8.10.0+25091+9b86bd7c.9 | 2:2.8.22-26.module+el8.10.0+25091+9b86bd7c.9 |
gimp-libsRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs | before 2:2.8.22-26.module+el8.10.0+25091+9b86bd7c.9 | 2:2.8.22-26.module+el8.10.0+25091+9b86bd7c.9 |
gimp-libs-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs | before 2:2.8.22-26.module+el8.10.0+25091+9b86bd7c.9 | 2:2.8.22-26.module+el8.10.0+25091+9b86bd7c.9 |
pygobject2Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs | before 0:2.28.7-5.module+el8.10.0+22676+becd68d6 | 0:2.28.7-5.module+el8.10.0+22676+becd68d6 |
pygobject2-codegenRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs | before 0:2.28.7-5.module+el8.10.0+22676+becd68d6 | 0:2.28.7-5.module+el8.10.0+22676+becd68d6 |
pygobject2-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs | before 0:2.28.7-5.module+el8.10.0+22676+becd68d6 | 0:2.28.7-5.module+el8.10.0+22676+becd68d6 |
pygobject2-debugsourceRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs | before 0:2.28.7-5.module+el8.10.0+22676+becd68d6 | 0:2.28.7-5.module+el8.10.0+22676+becd68d6 |
pygobject2-develRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs | before 0:2.28.7-5.module+el8.10.0+22676+becd68d6 | 0:2.28.7-5.module+el8.10.0+22676+becd68d6 |
pygobject2-docRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs | before 0:2.28.7-5.module+el8.10.0+22676+becd68d6 | 0:2.28.7-5.module+el8.10.0+22676+becd68d6 |
pygtk2Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs | before 0:2.24.0-25.module+el8.9.0+21228+8e80d31d | 0:2.24.0-25.module+el8.9.0+21228+8e80d31d |
pygtk2-codegenRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs | before 0:2.24.0-25.module+el8.9.0+21228+8e80d31d | 0:2.24.0-25.module+el8.9.0+21228+8e80d31d |
pygtk2-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs | before 0:2.24.0-25.module+el8.9.0+21228+8e80d31d | 0:2.24.0-25.module+el8.9.0+21228+8e80d31d |
pygtk2-debugsourceRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs | before 0:2.24.0-25.module+el8.9.0+21228+8e80d31d | 0:2.24.0-25.module+el8.9.0+21228+8e80d31d |
pygtk2-develRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs | before 0:2.24.0-25.module+el8.9.0+21228+8e80d31d | 0:2.24.0-25.module+el8.9.0+21228+8e80d31d |
pygtk2-docRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs | before 0:2.24.0-25.module+el8.9.0+21228+8e80d31d | 0:2.24.0-25.module+el8.9.0+21228+8e80d31d |
python2-cairoRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs | before 0:1.16.3-7.module+el8.10.0+22676+becd68d6 | 0:1.16.3-7.module+el8.10.0+22676+becd68d6 |
python2-cairo-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs | before 0:1.16.3-7.module+el8.10.0+22676+becd68d6 | 0:1.16.3-7.module+el8.10.0+22676+becd68d6 |
python2-cairo-develRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs | before 0:1.16.3-7.module+el8.10.0+22676+becd68d6 | 0:1.16.3-7.module+el8.10.0+22676+becd68d6 |
python2-pycairoRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs | before 0:1.16.3-7.module+el8.10.0+22676+becd68d6 | 0:1.16.3-7.module+el8.10.0+22676+becd68d6 |
python2-pycairo-debugsourceRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs | before 0:1.16.3-7.module+el8.10.0+22676+becd68d6 | 0:1.16.3-7.module+el8.10.0+22676+becd68d6 |
gimpRed Hat:rhel_e4s:9.2::appstream From an advisory covering 17 CVEs | before 2:2.99.8-4.el9_2.7 | 2:2.99.8-4.el9_2.7 |
gimp-debuginfoRed Hat:rhel_e4s:9.2::appstream From an advisory covering 17 CVEs | before 2:2.99.8-4.el9_2.7 | 2:2.99.8-4.el9_2.7 |
gimp-debugsourceRed Hat:rhel_e4s:9.2::appstream From an advisory covering 17 CVEs | before 2:2.99.8-4.el9_2.7 | 2:2.99.8-4.el9_2.7 |
gimp-devel-tools-debuginfoRed Hat:rhel_e4s:9.2::appstream From an advisory covering 17 CVEs | before 2:2.99.8-4.el9_2.7 | 2:2.99.8-4.el9_2.7 |
gimp-libsRed Hat:rhel_e4s:9.2::appstream From an advisory covering 17 CVEs | before 2:2.99.8-4.el9_2.7 | 2:2.99.8-4.el9_2.7 |
gimp-libs-debuginfoRed Hat:rhel_e4s:9.2::appstream From an advisory covering 17 CVEs | before 2:2.99.8-4.el9_2.7 | 2:2.99.8-4.el9_2.7 |
gimpRed Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs | before 2:3.0.4-8.el9_9.4 | 2:3.0.4-8.el9_9.4 |
gimp-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs | before 2:3.0.4-8.el9_9.4 | 2:3.0.4-8.el9_9.4 |
gimp-debugsourceRed Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs | before 2:3.0.4-8.el9_9.4 | 2:3.0.4-8.el9_9.4 |
gimp-devel-tools-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs | before 2:3.0.4-8.el9_9.4 | 2:3.0.4-8.el9_9.4 |
gimp-libsRed Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs | before 2:3.0.4-8.el9_9.4 | 2:3.0.4-8.el9_9.4 |
gimp-libs-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs | before 2:3.0.4-8.el9_9.4 | 2:3.0.4-8.el9_9.4 |
gimpRocky Linux:8 From an advisory covering 4 CVEs | before 2:2.8.22-26.module+el8.10.0+40075+a21479b4.4 | 2:2.8.22-26.module+el8.10.0+40075+a21479b4.4 |
gimpRocky Linux:8 From an advisory covering 4 CVEs | before 2:2.8.22-26.module+el8.10.0+1927+52edb5a0 | 2:2.8.22-26.module+el8.10.0+1927+52edb5a0 |
gimpRocky Linux:8 From an advisory covering 4 CVEs | before 2:2.8.22-26.module+el8.10.0+40308+ebf9d253.8 | 2:2.8.22-26.module+el8.10.0+40308+ebf9d253.8 |
gimpRocky Linux:8 From an advisory covering 4 CVEs | before 2:2.8.22-26.module+el8.10.0+40033+6fd27379.3 | 2:2.8.22-26.module+el8.10.0+40033+6fd27379.3 |
gimpRocky Linux:8 From an advisory covering 4 CVEs | before 2:2.8.22-26.module+el8.10.0+40181+ad0e3a65.6 | 2:2.8.22-26.module+el8.10.0+40181+ad0e3a65.6 |
gimpRocky Linux:8 From an advisory covering 4 CVEs | before 2:2.8.22-26.module+el8.10.0+1998+a08ccc48.2 | 2:2.8.22-26.module+el8.10.0+1998+a08ccc48.2 |
gimpRocky Linux:8 From an advisory covering 4 CVEs | before 2:2.8.22-26.module+el8.10.0+40134+eab491b1.5 | 2:2.8.22-26.module+el8.10.0+40134+eab491b1.5 |
pygobject2Rocky Linux:8 From an advisory covering 4 CVEs | before 0:2.28.7-5.module+el8.10.0+1927+52edb5a0 | 0:2.28.7-5.module+el8.10.0+1927+52edb5a0 |
pygtk2Rocky Linux:8 From an advisory covering 4 CVEs | before 0:2.24.0-25.module+el8.9.0+1723+9bc93544 | 0:2.24.0-25.module+el8.9.0+1723+9bc93544 |
python2-pycairoRocky Linux:8 From an advisory covering 4 CVEs | before 0:1.16.3-7.module+el8.10.0+1927+52edb5a0 | 0:1.16.3-7.module+el8.10.0+1927+52edb5a0 |
gimpSUSE:Linux Enterprise Module for Package Hub 15 SP7 From an advisory covering 10 CVEs | before 2.10.30-150400.3.79.1 | 2.10.30-150400.3.79.1 |
gimpSUSE:Linux Enterprise Workstation Extension 15 SP7 From an advisory covering 10 CVEs | before 2.10.30-150400.3.79.1 | 2.10.30-150400.3.79.1 |
gimpUbuntu:Pro:16.04:LTS | All versions, plus listed versions 2.8.14-1ubuntu22.8.14-1.2ubuntu12.8.16-1ubuntu12.8.16-1ubuntu1.12.8.16-1ubuntu1.1+esm12.8.16-1ubuntu1.1+esm22.8.16-1ubuntu1.1+esm3 | None known |
gimpUbuntu:Pro:18.04:LTS | All versions, plus listed versions 2.8.20-12.8.20-1.12.8.20-22.8.22-12.8.22-1ubuntu0.1~esm12.8.22-1ubuntu0.1~esm22.8.22-1ubuntu0.1~esm3 | None known |
gimpUbuntu:Pro:20.04:LTS | All versions, plus listed versions 2.10.8-22.10.14-22.10.14-2build12.10.14-2ubuntu12.10.14-3 Show 5 moreShow less2.10.18-12.10.18-1ubuntu0.12.10.18-1ubuntu0.1+esm12.10.18-1ubuntu0.1+esm22.10.18-1ubuntu0.1+esm3 | None known |
gimpUbuntu:Pro:22.04:LTS | All versions, plus listed versions 2.10.24-22.10.28-12.10.30-12.10.30-1build12.10.30-1ubuntu0.12.10.30-1ubuntu0.1+esm12.10.30-1ubuntu0.1+esm22.10.30-1ubuntu0.1+esm3 | None known |
gimpUbuntu:Pro:24.04:LTS | All versions, plus listed versions 2.10.34-12.10.36-12.10.36-22.10.36-3build22.10.36-3build3 Show 4 moreShow less2.10.36-3ubuntu0.24.04.12.10.36-3ubuntu0.24.04.1+esm12.10.36-3ubuntu0.24.04.1+esm22.10.36-3ubuntu0.24.04.1+esm3 | None known |
gimpUbuntu:26.10 | All versions, plus listed versions 3.2.2-13.2.4-13.2.4-23.2.4-33.2.6-1 | None known |
gimpUbuntu:26.04:LTS | All versions, plus listed versions 3.0.4-6.13.0.4-6.23.0.6-13.2.0~RC2-23.2.0~RC2-3 Show 7 moreShow less3.2.0~RC2-3.13.2.0~RC2-3.23.2.0~RC2-3.33.2.0~RC3-13.2.0-13.2.2-13.2.2-1ubuntu0.26.04.1 | None known |
gimpopenSUSE:Tumbleweed From an advisory covering 6 CVEs | before 3.2.6-3.1 | 3.2.6-3.1 |
gimpopenSUSE:Leap 16.0 From an advisory covering 11 CVEs | before 3.0.8-bp160.10.1 | 3.0.8-bp160.10.1 |
What each source reports
CVE List Score used
Gimp: gimp: heap-based buffer overflow in ico loader via integer overflow in embedded png dimensions
A flaw was found in GIMP's ICO file loader. When processing an ICO file containing an embedded PNG image, an integer overflow can occur during the calculation of the required buffer size. This leads to an undersized buffer being allocated, causing a heap-based buffer overflow when the decoded pixel data is written. A remote attacker could exploit this by crafting a malicious ICO file, which, when opened, could lead to arbitrary code execution or a crash.
- Record
CVE-2026-90948- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-11
EUVDEUVD-2026-77471
A flaw was found in GIMP's ICO file loader. When processing an ICO file containing an embedded PNG image, an integer overflow can occur during the calculation of the required buffer size. This leads to an undersized buffer being allocated, causing a heap-based buffer overflow when the decoded pixel data is written. A remote attacker could exploit this by crafting a malicious ICO file, which, when opened, could lead to arbitrary code execution or a crash.
- Record
EUVD-2026-77471- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-11
GitHub AdvisoriesGHSA-4gcm-x544-rhh4
A flaw was found in GIMP's ICO file loader. When processing an ICO file containing an embedded...
A flaw was found in GIMP's ICO file loader. When processing an ICO file containing an embedded PNG image, an integer overflow can occur during the calculation of the required buffer size. This leads to an undersized buffer being allocated, causing a heap-based buffer overflow when the decoded pixel data is written. A remote attacker could exploit this by crafting a malicious ICO file, which, when opened, could lead to arbitrary code execution or a crash.
- Record
GHSA-4gcm-x544-rhh4- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-11
NVD
A flaw was found in GIMP's ICO file loader. When processing an ICO file containing an embedded PNG image, an integer overflow can occur during the calculation of the required buffer size. This leads to an undersized buffer being allocated, causing a heap-based buffer overflow when the decoded pixel data is written. A remote attacker could exploit this by crafting a malicious ICO file, which, when opened, could lead to arbitrary code execution or a crash.
- Record
CVE-2026-90948- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-11
OSVDEBIAN-CVE-2026-90948
A flaw was found in GIMP's ICO file loader. When processing an ICO file containing an embedded PNG image, an integer overflow can occur during the calculation of the required buffer size. This leads to an undersized buffer being allocated, causing a heap-based buffer overflow when the decoded pixel data is written. A remote attacker could exploit this by crafting a malicious ICO file, which, when opened, could lead to arbitrary code execution or a crash.
- Record
DEBIAN-CVE-2026-90948- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-12
OSVRHSA-2026:75575
Red Hat Security Advisory: gimp security update
- Record
RHSA-2026:75575- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-13
Show 13 moreShow less
OSVRHSA-2026:84744
Red Hat Security Advisory: gimp:2.8 security update
- Record
RHSA-2026:84744- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-13
OSVRHSA-2026:93589
Red Hat Security Advisory: gimp security update
- Record
RHSA-2026:93589- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H - Updated
- 2026-11-13
OSVRHSA-2026:98462
Red Hat Security Advisory: gimp security update
- Record
RHSA-2026:98462- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-13
OSVRLSA-2026:84744
Important: gimp:2.8 security update
The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.
Security Fix(es):
gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset file (CVE-2026-90947)
gimp: gimp: heap-based buffer overflow in ICO loader via integer overflow in embedded PNG dimensions (CVE-2026-90948)
gimp: integer overflow when generating a thumbnail preview for a PSD file (CVE-2026-92248)
gimp: gimp: out-of-bounds write in GIMPressionist plugin via crafted preset file (CVE-2026-97185)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:84744- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-90948
A flaw was found in GIMP's ICO file loader. When processing an ICO file containing an embedded PNG image, an integer overflow can occur during the calculation of the required buffer size. This leads to an undersized buffer being allocated, causing a heap-based buffer overflow when the decoded pixel data is written. A remote attacker could exploit this by crafting a malicious ICO file, which, when opened, could lead to arbitrary code execution or a crash.
- Record
UBUNTU-CVE-2026-90948- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVALSA-2026:75575No score
Important: gimp security update
The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.
Security Fix(es):
- gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset file (CVE-2026-90947)
- gimp: gimp: heap-based buffer overflow in ICO loader via integer overflow in embedded PNG dimensions (CVE-2026-90948)
- gimp: integer overflow when generating a thumbnail preview for a PSD file (CVE-2026-92248)
- gimp: gimp: out-of-bounds write in GIMPressionist plugin via crafted preset file (CVE-2026-97185)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:75575- Updated
- 2026-11-02
OSVALSA-2026:84744No score
Important: gimp:2.8 security update
The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.
Security Fix(es):
- gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset file (CVE-2026-90947)
- gimp: gimp: heap-based buffer overflow in ICO loader via integer overflow in embedded PNG dimensions (CVE-2026-90948)
- gimp: integer overflow when generating a thumbnail preview for a PSD file (CVE-2026-92248)
- gimp: gimp: out-of-bounds write in GIMPressionist plugin via crafted preset file (CVE-2026-97185)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:84744- Updated
- 2026-11-02
OSVCLSA-2026-1791479721No score
gimp: Fix of 10 CVEs
- CVE-2026-90948: compute the ICO PNG frame size and the image buffer size with g_size_checked_mul () in ico_read_png () and ico_load_image ()
- CVE-2026-90947: clamp the preset "Number of lights" to NUM_LIGHTS in the Lighting Effects load_preset_response ()
- CVE-2026-92248: bound the PSD JPEG thumbnail dimensions and compute its buffer size with g_size_checked_mul () in load_resource_1033 ()
- CVE-2026-97185: reject out-of-range vector indices in the GIMPressionist preset loader set_orient_vector () and set_size_vector ()
- Record
CLSA-2026-1791479721- Updated
- 2026-11-02
OSVCLSA-2026-1791539516No score
gimp: Fix of 4 CVEs
- CVE-2026-90948: compute the ICO PNG frame size and the image buffer size with g_size_checked_mul () in ico_read_png () and ico_load_image ()
- CVE-2026-90947: clamp the preset "Number of lights" to NUM_LIGHTS in the Lighting Effects load_preset_response ()
- CVE-2026-92248: bound the PSD JPEG thumbnail dimensions and compute its buffer size with g_size_checked_mul () in load_resource_1033 ()
- CVE-2026-97185: reject out-of-range vector indices in the GIMPressionist preset loader set_orient_vector () and set_size_vector ()
- Record
CLSA-2026-1791539516- Updated
- 2026-11-02
OSVMGASA-2026-0578No score
Updated gimp packages fix security vulnerabilities
This update to v. 3.2.8 fixes several security issues.
- Record
MGASA-2026-0578- Updated
- 2026-11-07
OSVopenSUSE-SU-2026:11890-1No score
gimp-3.2.6-3.1 on GA media
These are all security issues fixed in the gimp-3.2.6-3.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11890-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:21959-1No score
Security update for gimp
This update for gimp fixes the following issues:
Changes in gimp:
- CVE-2026-18304: GIMP TIF File Parsing Integer Overflow Remote Code Execution Vulnerability (bsc#1276233)
- CVE-2026-18301: GIMP PSD File Parsing Integer Overflow Remote Code Execution Vulnerability (bsc#1276230)
- CVE-2026-18307: GIMP TIF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (bsc#1276236)
- CVE-2026-18303: GIMP TIF File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (bsc#1276232)
- CVE-2026-18308: GIMP TIF File Parsing Integer Overflow Remote Code Execution Vulnerability (bsc#1276237)
- CVE-2026-18306: GIMP SGI File Parsing Integer Overflow Remote Code Execution Vulnerability (bsc#1276235)
- CVE-2026-18305: GIMP TIF File Parsing Integer Overflow Remote Code Execution Vulnerability (bsc#1276234)
- CVE-2026-18302: GIMP TIF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (bsc#1276231)
- CVE-2026-90947: out-of-bounds write in the lighting effects plugin when processing a crafted preset file due to improper validation of the number of light sources (bsc#1280511)
- CVE-2026-90948: When processing an ICO file containing an embedded PNG image, an integer overflow can occur during the calculation of the required buffer size (bsc#1280512)
- CVE-2026-92248: When generating a thumbnail preview for a specially crafted PSD (Photoshop Document) image file, an integer overflow occurs during the multiplication of values from an embedded JPEG header (bsc#1280739)
- Record
openSUSE-SU-2026:21959-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:4409-1No score
Security update for gimp
This update for gimp fixes the following issues:
- CVE-2026-18301: Vulnerability Report at read_channel_data (bsc#1276230).
- CVE-2026-18302: TIF File Parsing Heap-based Buffer Overflow (bsc#1276231).
- CVE-2026-18303: TIF File Parsing Stack-based Buffer Overflow (bsc#1276232).
- CVE-2026-18304: TIF File Parsing Integer Overflow Remote Code Execution Vulnerability (bsc#1276233).
- CVE-2026-18305: TIF File Parsing Integer Overflow Remote Code Execution Vulnerability (bsc#1276234).
- CVE-2026-18306: SGI File Parsing Integer Overflow Remote Code Execution Vulnerability (bsc#1276235).
- CVE-2026-18307: File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (bsc#1276236).
- CVE-2026-90947: out-of-bounds write in the lighting effects plugin when processing a crafted preset file due to improper validation of the number of light sources (bsc#1280511).
- CVE-2026-90948: heap buffer overflow in the ICO loader when processing ICO files with embedded PNG images due to an integer overflow during calculation of buffer sizes (bsc#1280512).
- CVE-2026-92248: integer overflow when generating a thumbnail preview for a PSD file can lead to a heap buffer overflow (bsc#1280739).
- Record
SUSE-SU-2026:4409-1- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | EUVD, GitHub Advisories, NVD, OSV | |
| references | CVE List | |
| affected, aliases, references | OSV | |
| affected | ||
| affected | NVD, OSV | |
| facts | EUVD, OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
access.redhat.com/errata/RHSA-2026:75575
bugzilla.redhat.com/show_bug.cgi?id=2533008
Show 151 moreShow less
gitlab.gnome.org/GNOME/gimp/-/work_items/16742
nvd.nist.gov/vuln/detail/CVE-2026-90948
github.com/advisories/GHSA-4gcm-x544-rhh4
errata.almalinux.org/9/ALSA-2026-75575.html
errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1791479721.html
security-tracker.debian.org/tracker/CVE-2026-90948
advisories.mageia.org/MGASA-2026-0578.html
bugs.mageia.org/show_bug.cgi?id=36194
lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/LUXP5VNBOZ64AC65YKLO3MBCA4XXR3YS
lists.debian.org/debian-security-announce/2026/msg00381.html
gimp.org/news/2026/09/10/gimp-3-2-6-released
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_75575.json
cve.org/CVERecord?id=CVE-2026-90947
zerodayinitiative.com/advisories/ZDI-26-454
errata.rockylinux.org/RLSA-2026:84744
suse.com/support/update/announcement/2026/suse-su-20264409-1
bugzilla.suse.com/1276230
ubuntu.com/security/CVE-2026-90948
This page doesn't list everything
Left out here: 8 versions. The JSON record has them.