CVE-2026-78475

A flaw was found in the file-pix (ESM) plugin in GIMP. When processing a specially crafted PIX image file, the plugin allocates a Variable-Length Array (VLA) on the stack without proper bounds checking, causing an unbounded stack allocation followed by a 21-byte stack over-read. This can result in a denial of service due to stack exhaustion and a limited information disclosure of stack memory contents into an intermediate file.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 4.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/security/cve/CVE-2026-78475	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2522072	Issue Tracking Vendor Advisory
https://gitlab.gnome.org/GNOME/gimp/-/work_items/16580	Issue Tracking Vendor Advisory Mitigation

Configurations

Configuration 1 (hide)

cpe:2.3:a:gimp:gimp:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*

History

12 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Se encontró una vulnerabilidad en el plugin file-pix (ESM) en GIMP. Al procesar un archivo de imagen PIX especialmente manipulado, el plugin asigna un array de longitud variable (VLA) en la pila sin una comprobación de límites adecuada, lo que provoca una asignación de pila ilimitada seguida de una lectura excesiva de la pila de 21 bytes. Esto puede resultar en una denegación de servicio debido al agotamiento de la pila y una revelación de información limitada del contenido de la memoria de la pila en un archivo intermedio.

Information

Published : 2026-08-24 18:17

Updated : 2026-10-12 22:10

NVD link : CVE-2026-78475

Mitre link : CVE-2026-78475

CVE.ORG link : CVE-2026-78475

JSON object : View

Products Affected

redhat

enterprise_linux

gimp

gimp

CWE

CWE-125

Out-of-bounds Read

{"id": "CVE-2026-78475", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-78475", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-24T19:57:37.522179Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 4.2, "exploitabilityScore": 1.8}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"vendor": "GNOME", "product": "GIMP", "versions": [{"status": "affected", "version": "3.0.0", "lessThan": "*", "versionType": "semver"}], "packageName": "gimp", "collectionURL": "https://gitlab.gnome.org/GNOME/gimp", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:6"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6", "packageName": "gimp", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:7"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "packageName": "gimp", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:8"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "packageName": "gimp:2.8/gimp", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:9"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "packageName": "gimp", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}]}], "published": "2026-08-24T18:17:34.807", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-78475", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522072", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://gitlab.gnome.org/GNOME/gimp/-/work_items/16580", "tags": ["Issue Tracking", "Vendor Advisory", "Mitigation"], "source": "secalert@redhat.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in the file-pix (ESM) plugin in GIMP. When processing a specially crafted PIX image file, the plugin allocates a Variable-Length Array (VLA) on the stack without proper bounds checking, causing an unbounded stack allocation followed by a 21-byte stack over-read. This can result in a denial of service due to stack exhaustion and a limited information disclosure of stack memory contents into an intermediate file."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en el plugin file-pix (ESM) en GIMP. Al procesar un archivo de imagen PIX especialmente manipulado, el plugin asigna un array de longitud variable (VLA) en la pila sin una comprobaci\u00f3n de l\u00edmites adecuada, lo que provoca una asignaci\u00f3n de pila ilimitada seguida de una lectura excesiva de la pila de 21 bytes. Esto puede resultar en una denegaci\u00f3n de servicio debido al agotamiento de la pila y una revelaci\u00f3n de informaci\u00f3n limitada del contenido de la memoria de la pila en un archivo intermedio."}], "lastModified": "2026-10-12T22:10:00.247", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gimp:gimp:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "31A92901-1F5A-4EC4-8164-6EB2F3F6C246", "versionEndIncluding": "3.3.1", "versionStartIncluding": "3.0.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7F6FB57C-2BC7-487C-96DD-132683AEB35D"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}