CVE-2026-80101: Out-of-bounds Read in GNOME GIMP

The vulnerability in GIMP's file-xwd plugin occurs because the plugin validates image width and bytes-per-line parameters independently rather than ensuring their combined values align with the allocated buffer size. This improper bounds checking leads to a heap out-of-bounds read when processing specially crafted XWD image files. The flaw can cause the application to crash (denial of service) or leak limited heap memory contents into the produced image. Exploitation requires local user interaction to open a malicious file. The CVSS 3.1 score is 4.4 (medium severity) with attack vector local, low complexity, no privileges required, and user interaction required. Red Hat's advisory confirms the issue and recommends not opening untrusted XWD files. No official fix or patch is currently documented.

Successful exploitation can cause GIMP to crash, resulting in denial of service. Additionally, limited information disclosure of heap memory contents may occur, potentially leaking sensitive data. The attack requires user interaction to open a crafted XWD file, which reduces exploitation likelihood. There is no indication of integrity impact or remote exploitation without user action.

Red Hat advises users to avoid opening XWD files from untrusted sources with GIMP to mitigate this vulnerability. No official patch or fix has been confirmed at this time. Users should monitor vendor advisories for updates regarding remediation.