Log in Start free

Vulnerability · Published Sep 14, 2026 · Assigned by redhat

CVE-2026-90948Gimp: gimp: heap-based buffer overflow in ico loader via integer overflow in embedded png dimensions

High 7.8

In plain English

A high-severity out-of-bounds write in Red Hat Enterprise Linux 6 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 86.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in GIMP's ICO file loader. When processing an ICO file containing an embedded PNG image, an integer overflow can occur during the calculation of the required buffer size. This leads to an undersized buffer being allocated, causing a heap-based buffer overflow when the decoded pixel data is written. A remote attacker could exploit this by crafting a malicious ICO file, which, when opened, could lead to arbitrary code execution or a crash.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8gimp2:2.8.22-26.module_el8.10.0+4306+69430cd5.9ALSA-2026:84744
AlmaLinux:9gimp2:3.0.4-4.el9_8.14ALSA-2026:75575
AlmaLinux:8gimp-devel2:2.8.22-26.module_el8.10.0+4306+69430cd5.9ALSA-2026:84744
AlmaLinux:8gimp-devel-tools2:2.8.22-26.module_el8.10.0+4306+69430cd5.9ALSA-2026:84744
AlmaLinux:8gimp-libs2:2.8.22-26.module_el8.10.0+4306+69430cd5.9ALSA-2026:84744
AlmaLinux:9gimp-libs2:3.0.4-4.el9_8.14ALSA-2026:75575
AlmaLinux:8pygobject22.28.7-5.module_el8.10.0+4267+35168c80ALSA-2026:84744
AlmaLinux:8pygobject2-codegen2.28.7-5.module_el8.10.0+4267+35168c80ALSA-2026:84744
AlmaLinux:8pygobject2-devel2.28.7-5.module_el8.10.0+4267+35168c80ALSA-2026:84744
AlmaLinux:8pygobject2-doc2.28.7-5.module_el8.10.0+4267+35168c80ALSA-2026:84744
AlmaLinux:8pygtk22.24.0-25.module_el8.9.0+3725+d1441900ALSA-2026:84744
AlmaLinux:8pygtk2-codegen2.24.0-25.module_el8.9.0+3725+d1441900ALSA-2026:84744
AlmaLinux:8pygtk2-devel2.24.0-25.module_el8.9.0+3725+d1441900ALSA-2026:84744
AlmaLinux:8pygtk2-doc2.24.0-25.module_el8.9.0+3725+d1441900ALSA-2026:84744
AlmaLinux:8python2-cairo1.16.3-7.module_el8.10.0+4267+35168c80ALSA-2026:84744
AlmaLinux:8python2-cairo-devel1.16.3-7.module_el8.10.0+4267+35168c80ALSA-2026:84744
Debian:12gimpno fix listedDEBIAN-CVE-2026-90948
Debian:13gimp3.0.4-3+deb13u11DEBIAN-CVE-2026-90948
Debian:14gimp3.2.6-1DEBIAN-CVE-2026-90948
Rocky Linux:8gimp2:2.8.22-26.module+el8.10.0+40033+6fd27379.3RLSA-2026:84744
Rocky Linux:8gimp2:2.8.22-26.module+el8.10.0+40181+ad0e3a65.6RLSA-2026:84744
Rocky Linux:8gimp2:2.8.22-26.module+el8.10.0+1998+a08ccc48.2RLSA-2026:84744
Rocky Linux:8gimp2:2.8.22-26.module+el8.10.0+40134+eab491b1.5RLSA-2026:84744
Rocky Linux:8gimp2:2.8.22-26.module+el8.10.0+40075+a21479b4.4RLSA-2026:84744
Rocky Linux:8gimp2:2.8.22-26.module+el8.10.0+1927+52edb5a0RLSA-2026:84744
Rocky Linux:8gimp2:2.8.22-26.module+el8.10.0+40308+ebf9d253.8RLSA-2026:84744
Rocky Linux:8pygobject20:2.28.7-5.module+el8.10.0+1927+52edb5a0RLSA-2026:84744
Rocky Linux:8pygtk20:2.24.0-25.module+el8.9.0+1723+9bc93544RLSA-2026:84744
Rocky Linux:8python2-pycairo0:1.16.3-7.module+el8.10.0+1927+52edb5a0RLSA-2026:84744
Ubuntu:26.04:LTSgimpno fix listedUBUNTU-CVE-2026-90948
Ubuntu:26.10gimpno fix listedUBUNTU-CVE-2026-90948

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 6 see references
Red Hat Red Hat Enterprise Linux 7 see references

Weakness: CWE-787 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References