High severity7.1NVD Advisory· Published Jul 27, 2026· Updated Aug 24, 2026
CVE-2026-66759
CVE-2026-66759
Description
A flaw was found in the file-icns plugin in GIMP. When applying a decompressed mask during ICNS image processing, the plugin reads from the mask data buffer without verifying if the cursor exceeds the allocated resource size. If a crafted file contains a truncated mask resource, the icns_decompress function continues reading past the bounds of the buffer. This out-of-bounds read vulnerability results in information disclosure of heap contents, where memory contents are leaked as alpha channel pixel values, or a crash leading to a denial of service if unmapped memory is accessed.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
11cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
- osv-coords4 versionspkg:rpm/almalinux/gimppkg:rpm/opensuse/gimp&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/gimp&distro=openSUSE%20Tumbleweedpkg:rpm/almalinux/gimp-libs
< 2:3.0.4-4.el9_8.9+ 3 more
- (no CPE)range: < 2:3.0.4-4.el9_8.9
- (no CPE)range: < 3.0.8-bp160.6.1
- (no CPE)range: < 3.2.4-3.1
- (no CPE)range: < 2:3.0.4-4.el9_8.9
Patches
Vulnerability mechanics
References
4- gitlab.gnome.org/GNOME/gimp/-/issues/16528nvdExploitIssue TrackingVendor Advisory
- access.redhat.com/security/cve/CVE-2026-66759nvdVendor Advisory
- bugzilla.redhat.com/show_bug.cginvdIssue TrackingVendor Advisory
- access.redhat.com/errata/RHSA-2026:50817nvdIssue Tracking
News mentions
1- GIMP: Three File Plugin Vulnerabilities Disclosed Together on July 28, 2026Vypr Intelligence · Jul 28, 2026