CVE-2026-58380 is an off-by-one vulnerability in the pnmscanner_gettoken() function of GIMP's PNM file format parser included in Red Hat Enterprise Linux 6. The function writes a null terminator one byte beyond the end of a stack-allocated buffer due to incorrect loop boundary checking. This memory corruption can result in denial of service or potentially arbitrary code execution. The CVSS 3.1 base score is 7.3, reflecting high impact on confidentiality, integrity, and availability. The vendor advisory linked does not specify a patch or remediation status.

Successful exploitation of this vulnerability can cause memory corruption leading to denial of service or arbitrary code execution on affected systems running Red Hat Enterprise Linux 6 with the vulnerable GIMP PNM parser. The CVSS vector indicates local attack vector with low complexity, requiring privileges and user interaction, and results in high confidentiality, integrity, and availability impact.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-58380 for current remediation guidance. Until a fix is available, avoid processing untrusted PNM files with the vulnerable GIMP parser to mitigate risk.