A flaw was found in the file-xwd plugin in GIMP. (CVE-2026-80101)

The file-xwd plugin in GIMP improperly validates the image width and bytes-per-line parameters independently rather than verifying their combined consistency with the allocated buffer size. This incorrect validation leads to improper bounds checking and a heap out-of-bounds read when processing specially crafted XWD image files. The flaw can cause the application to crash, resulting in denial of service, or may disclose limited heap memory contents in the produced image. Multiple specific versions of GIMP are affected as listed. No known exploits in the wild have been reported. The CVSS v3.1 base score is 4.4, reflecting a medium severity with local attack vector, low complexity, no privileges required, user interaction required, unchanged scope, low confidentiality impact, no integrity impact, and low availability impact.

Successful exploitation can cause the GIMP application to crash, leading to denial of service. Additionally, limited information disclosure of heap memory contents may occur in the produced image. There is no indication of integrity impact or elevated privileges required. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid opening untrusted or specially crafted XWD image files with the affected versions of GIMP to mitigate risk.