A heap-buffer-overflow vulnerability exists in the APNG (Animated PNG) file loader of GIMP. This flaw occurs when the `fcTL` width exceeds the `IHDR` width, leading to pixel data being written past the end of a heap allocation. Additionally, a heap-based buffer overflow exists in the DDS plug-in due to a BPP mismatch in the `load_layer()` function. Both vulnerabilities can be triggered by opening a specially crafted image file, potentially leading to code execution.
References
| Link | Resource |
|---|---|
| https://access.redhat.com/errata/RHSA-2026:50817 | Issue Tracking |
| https://access.redhat.com/errata/RHSA-2026:73768 | Issue Tracking |
| https://access.redhat.com/errata/RHSA-2026:80509 | |
| https://access.redhat.com/security/cve/CVE-2026-42169 | Vendor Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2461725 | Issue Tracking Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
12 Oct 2026, 03:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
30 Sep 2026, 18:31
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:redhat:enterprise_linux_eus:9.6:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* |
|
| First Time |
Redhat
Redhat enterprise Linux Eus Redhat enterprise Linux |
|
| References | () https://access.redhat.com/errata/RHSA-2026:50817 - Issue Tracking | |
| References | () https://access.redhat.com/errata/RHSA-2026:73768 - Issue Tracking | |
| References | () https://access.redhat.com/security/cve/CVE-2026-42169 - Vendor Advisory | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=2461725 - Issue Tracking, Vendor Advisory |
30 Sep 2026, 15:22
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Information
Published : 2026-08-04 04:16
Updated : 2026-10-12 03:17
NVD link : CVE-2026-42169
Mitre link : CVE-2026-42169
CVE.ORG link : CVE-2026-42169
JSON object : View
Products Affected
redhat
- enterprise_linux_eus
- enterprise_linux
CWE
CWE-131
Incorrect Calculation of Buffer Size