GIMP: Three File Plugin Vulnerabilities Disclosed Together on July 28, 2026
Three vulnerabilities in GIMP's file format plugins (ICNS, SGI, FITS) were disclosed on July 28, 2026, potentially leading to memory corruption.
Key findings
- Three vulnerabilities disclosed together in GIMP affect its file-icns, file-sgi, and file-fits plugins.
- Flaws stem from improper validation of image dimensions, leading to memory corruption.
- CVE-2026-66759 involves buffer over-read in ICNS mask processing.
- CVE-2026-66757 and CVE-2026-66758 are due to integer overflows in SGI and FITS file parsing, respectively.
- Vulnerabilities reported in Debian's GIMP package, impacting users on Debian-based systems.
On July 28, 2026, three vulnerabilities were disclosed together in GIMP, the GNU Image Manipulation Program. These flaws, all affecting different file format plugins, could lead to memory corruption and potential denial-of-service conditions. The vulnerabilities were reported as part of the Debian gimp package, indicating potential impact for users running GIMP on Debian-based systems.
The vulnerabilities are:
File-ICNS Plugin Flaw (CVE-2026-66759)
This vulnerability exists within the file-icns plugin, which handles the ICNS image format. The issue arises when processing a decompressed mask during ICNS image parsing. The plugin fails to validate if the cursor exceeds the allocated resource size before reading from the mask data buffer. A specially crafted file with a truncated mask resource could trigger this condition in the icns_decompress function, potentially leading to memory corruption.
File-SGI Plugin Flaw (CVE-2026-66757)
Affecting the file-sgi plugin for Silicon Graphics Image (SGI) files, this vulnerability involves the allocation of memory for a row table. The plugin reads the image header dimensions (ysize and zsize) as 16-bit unsigned integers. If a crafted SGI file sets both dimensions to their maximum value (65535), the subsequent multiplication ysize * would result in an integer overflow, leading to an undersized memory allocation and potential heap corruption.
File-FITS Plugin Flaw (CVE-2026-66758)
The file-fits plugin, responsible for processing Flexible Image Transport System (FITS) files, is impacted by this vulnerability. The plugin calculates memory allocation sizes for image width and height using signed 32-bit integers. When a crafted FITS file provides excessively large values for both width and height, their product can exceed 2^31, causing an integer overflow. This overflow results in an undersized heap-based buffer being allocated, which can be exploited for memory corruption.
All three vulnerabilities appear to stem from improper handling of image file metadata and calculations within specific GIMP plugins. The common theme is the potential for integer overflows or buffer over-reads due to a lack of validation on input dimensions, leading to memory safety issues.
As these vulnerabilities were disclosed together and affect specific plugins, users are advised to update their GIMP installations to the latest available version that includes patches for these issues. While no specific exploitation details or threat actor information were provided in the disclosures, such memory corruption vulnerabilities can often be leveraged for denial-of-service attacks or, in some cases, more severe code execution.
The timely disclosure and patching of these plugin-specific flaws highlight the ongoing efforts to secure complex software like GIMP. Users should remain vigilant and apply updates promptly to mitigate the risks associated with these vulnerabilities. The focus on file format plugins underscores the importance of robust input validation when handling external data.