A flaw was found in GIMP. A remote attacker could exploit this by tricking a user into opening a specially crafted PAA (Paint Shop Pro Array) image… (CVE-2026-6695)

CVE-2026-6695 is a heap-based out-of-bounds write vulnerability in GIMP's PAA file format plugin, specifically in the decode_lzss() function. When a user opens a specially crafted .paa image file, data can be written beyond the intended memory buffer, causing heap metadata corruption. This memory corruption could enable an attacker to execute arbitrary code on the affected system. The attack vector requires local user interaction (opening the malicious file). The vulnerability affects multiple specific GIMP package versions distributed in Ubuntu and Red Hat Enterprise Linux environments. No known exploits are reported in the wild. The vulnerability impacts availability and potentially allows remote code execution via user interaction.

The vulnerability allows an attacker to cause heap metadata corruption by writing out-of-bounds in memory when processing a crafted .paa image file. This can lead to denial of service (application crash) or potentially arbitrary code execution with the privileges of the user running GIMP. Confidentiality and integrity impacts are not indicated. Exploitation requires the user to open a malicious file locally.

Users should avoid opening .paa files from untrusted sources to mitigate this issue. If GIMP is not required, removing the 'gimp' package is recommended to eliminate the attack vector. No official patch information is provided in the advisory, so patch status is not yet confirmed—check the vendor advisory for updates. There are no indications that the vulnerability is mitigated or fixed at this time.