GIMP: Four Image Plugin Vulnerabilities Disclosed, Ranging Medium to High Severity
A batch of four vulnerabilities affecting GIMP image format plugins was disclosed between August 24-26, 2026, with severities ranging from Medium to High.
Key findings
- Four GIMP vulnerabilities disclosed between Aug 24-26, 2026, impacting image format plugins.
- Vulnerabilities range from Medium (CVE-2026-79902, CVE-2026-80101, CVE-2026-78475) to High (CVE-2026-78465).
- Flaws include unbounded stack allocation, improper boundary checks, and heap buffer overflows.
- Issues affect Seattle FilmWorks, file-xwd, file-pix (ESM), and file-pcx plugins.
- CVE-2026-78465 specifically impacts 32-bit GIMP builds.
On August 24-26, 2026, a batch of four vulnerabilities was disclosed for the GIMP image editor. The vulnerabilities, all related to how GIMP processes specific image file formats, range in severity from Medium to High, with three of the four rated as Medium. These flaws primarily impact various GIMP plugins responsible for handling different image types, potentially leading to denial of service conditions.
The disclosed vulnerabilities affect several image format plugins within GIMP:
- **CVE-2026-79902**: This Medium severity vulnerability resides in the Seattle FilmWorks plugin. It arises from an unbounded stack allocation due to a lack of integer overflow checks when processing crafted SFW image files, leading to a denial of service.
- **CVE-2026-80101**: A Medium severity flaw in the file-xwd plugin, this issue stems from inconsistent validation of image width and bytes-per-line parameters when processing XWD files. This can result in improper boundary checks.
- **CVE-2026-78475**: Affecting the file-pix (ESM) plugin, this Medium severity vulnerability involves an unbounded stack allocation and a subsequent 21-byte stack over-read when processing specially crafted PIX image files. This also results in a denial of service.
- **CVE-2026-78465**: Rated as High severity, this vulnerability specifically impacts 32-bit builds of GIMP. When processing a crafted PCX image file with a specific configuration (4 color planes and large dimensions), the plugin's memory allocation calculation can lead to an integer overflow, potentially causing a heap buffer overflow.
The vulnerabilities were disclosed over a two-day period, with CVE-2026-78465 and CVE-2026-78475 published on August 24, 2026, followed by CVE-2026-80101 on August 25, and CVE-2026-79902 on August 26. All identified issues are related to improper handling of image file data within specific GIMP plugins, leading to crashes or potential memory corruption.
As of the disclosure, there is no information indicating these vulnerabilities are being actively exploited in the wild. Users are advised to update their GIMP installations to the latest available version to mitigate these risks. The specific versions affected and patched are not detailed in the provided information, but the nature of these vulnerabilities suggests that applying the latest security updates is crucial for maintaining the stability and security of the GIMP application.
This batch of vulnerabilities highlights the importance of secure coding practices, particularly in handling external file formats, even within mature open-source projects like GIMP. Users should remain vigilant and apply updates promptly as they become available from the GIMP project to protect against potential denial of service attacks or other impacts stemming from these flaws. The focus on plugin-specific vulnerabilities underscores the need for thorough security audits of all components within complex software.