Log in Start free

Vulnerability · Published Jul 27, 2026 · Assigned by redhat

CVE-2026-66757Gimp: signed integer overflow in file-sgi (sgi-lib) causes the plugin to crash on rle sgi images

Medium 5.5

In plain English

A medium-severity integer overflow in GIMP from GNOME. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.2%top 85.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A flaw was found in the file-sgi plugin in GIMP. When processing an RLE-compressed SGI image, the plugin allocates memory for a row table. The image header dimensions (ysize and zsize) are read as 16-bit unsigned integers. If a crafted file sets both dimensions to their maximum value (65535), the multiplication ysize * zsize overflows the standard 32-bit int boundary before being passed to calloc. This integer overflow issue results in undefined behavior, aborting the plugin and causing a denial of service.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12gimpno fix listedDEBIAN-CVE-2026-66757
Debian:13gimpno fix listedDEBIAN-CVE-2026-66757
Debian:14gimp3.2.6-1DEBIAN-CVE-2026-66757
Ubuntu:26.04:LTSgimpno fix listedUBUNTU-CVE-2026-66757
Ubuntu:26.10gimpno fix listedUBUNTU-CVE-2026-66757

Affected products (as reported)

VendorProductVersions
GNOME GIMP see references
Red Hat Red Hat Enterprise Linux 6 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references

Weakness: CWE-190 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References