VYPR
Published Aug 28, 2026· Updated Aug 30, 2026· 1 source

GNOME Foundation: Batch of 16 CVEs Hits GIMP, Nokogiri, Dia, and More

Key findings • 16 CVEs disclosed between Aug 25-28, 2026, affecting GIMP, Nokogiri, Dia, file-roller, libsoup, and gdk-pixbuf. • Multiple GIMP image parsing plugins vulnerable to DoS via heap…

Key findings

  • 16 CVEs disclosed between Aug 25-28, 2026, affecting GIMP, Nokogiri, Dia, file-roller, libsoup, and gdk-pixbuf.
  • Multiple GIMP image parsing plugins vulnerable to DoS via heap out-of-bounds reads and stack overflows.
  • Nokogiri affected by critical and high-severity vulnerabilities in bundled libxml2, including use-after-free and integer overflows.
  • High-severity buffer overflow in Dia diagram editor and file-roller archive processor.
  • Issues range from medium (CVSS 4.4) to critical (CVSS 9.8), with multiple high-severity flaws.
  • Patches available in updated versions of GIMP, Nokogiri, and other affected components.

On August 25, 2026, a significant batch of 16 vulnerabilities was disclosed across various components within the GNOME Foundation's ecosystem, primarily affecting GIMP and Nokogiri. The disclosures, spanning from August 25th to August 28th, highlight issues ranging from critical to medium severity, with many related to improper handling of image files and XML parsing.

Several GIMP plugins were found to have vulnerabilities stemming from insufficient validation of parameters when processing specific image file formats. CVE-2026-82343 in the file-psd plugin and CVE-2026-82328 in the file-ico plugin involve improper memory bounds checking due to incorrect validation of channel-count and palette count parameters, respectively, leading to heap out-of-bounds reads and stack out-of-bounds accesses. Similarly, CVE-2026-82330 in the file-pvr plugin suffers from a missing memory bounds check in its VQ decoder, resulting in a heap out-of-bounds read. The file-iff plugin is affected by CVE-2026-82324 due to improper validation of HAM row size and mishandling of color planes, bypassing memory bounds checking. CVE-2026-80101 in the file-xwd plugin also involves improper bounds checking due to independent validation of image width and bytes-per-line parameters. These GIMP-related flaws primarily result in denial-of-service conditions due to application crashes.

The Nokogiri component, a dependency used for processing XML, was impacted by a series of critical and high-severity vulnerabilities, largely stemming from underlying issues in the bundled libxml2 library. CVE-2024-58378, a critical use-after-free vulnerability in libxml2's xmlTextReader module, affects Nokogiri versions prior to 1.15.6 and 1.16.2. CVE-2022-51000, another critical vulnerability, involves denial-of-service via libxslt and libxml2 issues in Nokogiri versions before 1.13.2. CVE-2022-50999, a high-severity integer overflow in libxml2 buffer handling, allows for out-of-bounds memory writes in Nokogiri versions before 1.13.5. Additionally, CVE-2022-50998 and CVE-2023-54354, both high severity, involve data corruption, double-free issues, and NULL pointer dereferences in XML Schema processing due to vulnerabilities in the bundled libxml2. CVE-2021-47996, also high severity, points to multiple vulnerabilities in libxml2, including memory leaks and buffer over-reads. CVE-2022-50998 also includes integer overflows when parsing with XML_PARSE_HUGE. CVE-2024-58377, a medium-severity issue, is related to a vulnerability in xmllint, though the maintainers state it has no impact on Nokogiri users as the tool is not exposed.

Beyond GIMP and Nokogiri, other components were also affected. CVE-2026-77658, a high-severity stack-based buffer overflow, exists in the Dia diagram editor when processing Network Bus objects due to a lack of upper bound validation on the 'bus_handles' attribute. CVE-2026-78322, a medium-severity flaw in file-roller, can lead to a stack buffer overflow and application crash when processing malicious 7z or RAR archives with excessively long file paths due to an unbounded string copy. CVE-2026-77680, a medium-severity issue in libsoup, relates to an algorithmic complexity flaw in HTTP Range header processing that persisted after a previous fix. Lastly, CVE-2026-81893, a medium-severity vulnerability in gdk-pixbuf, can cause an out-of-bounds write when loading crafted JPEG images with chunked ICC profile markers, potentially crashing the application.

The majority of these vulnerabilities appear to be fixed in updated versions of the respective software. For GIMP plugins, the fixes are likely included in recent GIMP releases. Nokogiri has seen multiple updates addressing these issues, with specific version numbers mentioned for fixes (e.g., Nokogiri 1.15.6, 1.16.2, 1.16.5, 1.13.2, 1.13.5, 1.13.9, 1.14.3, and 1.11.4). Users are strongly advised to update GIMP, Nokogiri, Dia, file-roller, and ensure their systems have the latest libsoup and gdk-pixbuf libraries to mitigate these risks.

This coordinated disclosure highlights the importance of secure coding practices, particularly in areas handling external data formats like images and XML. The prevalence of memory safety issues (buffer overflows, out-of-bounds reads/writes, use-after-free) across multiple components underscores the ongoing challenges in software security. Users of GNOME Foundation software should prioritize applying updates promptly to protect against potential exploitation of these vulnerabilities. The span of affected components suggests a broad impact across the GNOME ecosystem.

Synthesized by Vypr AI