CVE-2026-78475 is an out-of-bounds read vulnerability in the file-pix (ESM) plugin of GIMP as shipped with Red Hat Enterprise Linux 6. The flaw arises from the plugin allocating a Variable-Length Array (VLA) on the stack without proper bounds checking when processing a crafted PIX image file. This leads to an unbounded stack allocation followed by a 21-byte stack over-read. The vulnerability can cause denial of service through stack exhaustion and limited information disclosure of stack memory contents into an intermediate file. Exploitation requires local user interaction to open a malicious PIX file in GIMP. Red Hat rates this vulnerability as medium severity with a CVSS 3.1 score of 6.1 (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H).

The vulnerability can cause a denial of service by exhausting stack memory, resulting in application crashes or restarts. Additionally, it allows limited disclosure of stack memory contents, which may include sensitive information such as cryptographic keys or memory addresses. This information disclosure could potentially aid in bypassing protection mechanisms like ASLR. The attack requires local user interaction to open a malicious PIX file, limiting the attack vector to local scenarios.

Red Hat advisory recommends not opening PIX image files from untrusted sources with GIMP to mitigate this vulnerability. No official patch or fix status is provided in the advisory at this time. Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-78475 for current remediation guidance.