A flaw was found in the file-pix (ESM) plugin in GIMP. (CVE-2026-78475)

CVE-2026-78475 describes a flaw in the file-pix (ESM) plugin of GIMP where processing a maliciously crafted PIX image file leads to allocation of a Variable-Length Array (VLA) on the stack without proper bounds checking. This results in an unbounded stack allocation followed by a 21-byte stack over-read. The vulnerability can cause denial of service through stack exhaustion and limited information disclosure of stack memory contents into an intermediate file. The affected versions are explicitly listed and span multiple GIMP releases. The CVSS 3.1 vector is AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H, reflecting local attack vector, low complexity, no privileges required, user interaction required, unchanged scope, low confidentiality impact, no integrity impact, and high availability impact.

Exploitation of this vulnerability can lead to denial of service due to stack exhaustion and limited disclosure of stack memory contents. The confidentiality impact is low, integrity impact is none, and availability impact is high. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor vendor advisories for updates and avoid processing untrusted PIX image files until a fix is available.