GIMP Vulnerability Allows Remote Code Execution via APNG File Parsing
A critical integer overflow vulnerability in GIMP's APNG file parsing, ZDI-26-462, allows remote attackers to execute arbitrary code on affected systems.
The popular open-source image editor GIMP has been found to contain a critical vulnerability that could allow remote attackers to execute arbitrary code on a user's system. The flaw, identified as ZDI-26-462 and assigned CVE-2026-18309, resides within the application's handling of the Animated Portable Network Graphics (APNG) file format.
According to the advisory from Zero Day Initiative (ZDI), the vulnerability stems from an integer overflow that occurs during the parsing of APNG files. This issue arises due to insufficient validation of user-supplied data, which can lead to an integer overflow before a buffer is allocated. Successful exploitation of this vulnerability could enable an attacker to execute code within the context of the current GIMP process.
Exploitation of this vulnerability requires user interaction. Attackers could trick victims into opening a specially crafted APNG file or visiting a malicious webpage that displays such a file. Once the malicious file is processed by GIMP, the integer overflow can be triggered, potentially leading to code execution.
The vulnerability has been assigned a CVSS score of 7.8, indicating a high severity level. While user interaction is a prerequisite, the potential for arbitrary code execution makes this a significant threat to users who handle or view APNG images within GIMP.
Developers have already released a patch to address this vulnerability. The fix is available through the GIMP project's GitLab repository, with a specific commit addressing the issue noted as c760c8309d18bdf5259f1e04ced0779462c7c636.
The vulnerability was initially reported to the vendor on April 17, 2026, and the coordinated public release of the advisory occurred on July 29, 2026. The advisory was updated on the same day.
This discovery highlights the ongoing challenges in securing complex software, particularly in areas involving file parsing and image formats, which can often be vectors for sophisticated attacks. Users are strongly advised to update their GIMP installations to the latest version to mitigate this risk.
This advisory details a separate integer overflow vulnerability, ZDI-26-461, affecting GIMP's handling of TIF files, distinct from the previously reported APNG file parsing flaw. While both vulnerabilities allow for remote code execution, this new flaw specifically targets the TIF parsing mechanism and has a CVSS score of 7.8, requiring user interaction to exploit by opening a malicious file or visiting a crafted webpage.
This new advisory, ZDI-26-457, details a separate integer overflow vulnerability within GIMP's TIF file parsing component, distinct from the APNG parsing flaw previously reported. While both vulnerabilities allow for remote code execution, this specific issue stems from improper validation during TIF file processing, leading to an integer overflow before buffer allocation. The vulnerability has been assigned CVE-2026-18304 and carries a CVSS score of 7.8.