CVE-2026-78475: Out-of-bounds Read in GNOME GIMP

The vulnerability in GNOME GIMP's file-pix (ESM) plugin arises from improper bounds checking when allocating a Variable-Length Array on the stack while processing PIX image files. This results in an unbounded stack allocation followed by a 21-byte stack over-read. The flaw can cause denial of service through stack exhaustion and limited information disclosure of stack memory into an intermediate file. Exploitation requires local user interaction by opening a crafted PIX file. The CVSS 3.1 vector is AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H, indicating local attack vector, low complexity, no privileges required, user interaction required, unchanged scope, low confidentiality impact, no integrity impact, and high availability impact. The vulnerability affects GIMP versions 3.0.0 and later. The Red Hat advisory recommends not opening PIX files from untrusted sources as mitigation.

The vulnerability can cause denial of service by exhausting stack memory, leading to application crashes. Additionally, it allows limited disclosure of stack memory contents, potentially leaking sensitive information such as cryptographic keys or memory addresses. However, exploitation requires user interaction to open a malicious PIX file, which reduces the likelihood of exploitation. There is no integrity impact reported. The availability impact is high due to potential crashes.

The vendor advisory states that to mitigate this vulnerability, users should avoid opening PIX files from untrusted sources with GIMP. No official patch or fix status is provided in the advisory, so patch status is not yet confirmed—check the vendor advisory for updates. Since exploitation requires user interaction, user education and cautious handling of PIX files are recommended.