CVE-2026-77652 is a heap-based buffer overflow vulnerability in the Dia diagram editor's WPG file format importer. The flaw arises from improper bounds checking when reading palette data, allowing an attacker to overflow the palette buffer. Exploitation requires a user to open a crafted WPG file, potentially leading to application crashes or arbitrary code execution. No special privileges are needed to trigger the vulnerability. The issue affects all Dia versions containing the vulnerable code path as of August 2026. Red Hat has assessed that this vulnerability does not affect any currently supported Red Hat products.
CVE-2026-79902 is an integer overflow vulnerability in the Seattle FilmWorks plugin of GIMP version 3.1.4. The flaw occurs when processing a specially crafted SFW image file, causing an unbounded stack allocation due to lack of integer overflow checks on a variable-length array. This leads to an application crash and denial of service. Exploitation requires local user interaction to open a malicious file, limiting the attack vector. The vulnerability has a medium severity rating with a CVSS score of 5.5.
CVE-2026-77658 is a stack-based buffer overflow vulnerability in the GNOME Dia diagram editor affecting versions 0.98.0 and earlier. The flaw occurs when processing Network Bus objects in Dia XML project files, where an attacker-controlled attribute "bus_handles" is used without upper bound validation. This leads to excessive stack allocation causing stack overflow, potential crashes, and possible memory corruption. Exploitation requires the victim to open a crafted .dia file and manipulate bus handles. The same pattern likely affects Tree objects as well. Red Hat has assessed that this vulnerability does not affect any currently supported Red Hat products.
A flaw was found in the file-xwd plugin in GIMP. When processing a specially crafted XWD image file, the plugin validates the image width and bytes-per-line parameters independently rather than ensuring their combined values are consistent with the allocated buffer size. This incorrect validation leads to improper bounds checking, causing a heap out-of-bounds read. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of heap memory contents into the produced image.
CVE-2026-78475 is a vulnerability in the file-pix (ESM) plugin of GNOME GIMP affecting versions 3.0.0 and later. It involves an out-of-bounds read caused by unbounded stack allocation of a Variable-Length Array (VLA) when processing specially crafted PIX image files. This flaw can lead to denial of service due to stack exhaustion and limited disclosure of stack memory contents. Exploitation requires convincing a user to open a malicious PIX file, reducing the likelihood of attack. The vulnerability has a medium severity rating with a CVSS score of 6.1.
CVE-2026-78465 is an integer overflow vulnerability in the file-pcx plugin of GIMP affecting only 32-bit builds. The flaw occurs when processing specially crafted PCX image files with 4 color planes and large dimensions, causing a 32-bit integer overflow during memory allocation size calculation. This leads to an undersized heap buffer allocation and subsequent heap-based buffer overflow when image data is written, resulting in memory corruption. Exploitation requires local user interaction to open a malicious PCX file. Successful exploitation may lead to arbitrary code execution or denial of service. Default security features like SELinux, ASLR, and NX reduce the likelihood of exploitation. No official patch or fix status is confirmed yet. Mitigation involves avoiding opening untrusted PCX files with GIMP.
CVE-2026-18487 is a medium severity vulnerability in the GNOME Epiphany browser where the address bar can be spoofed. An attacker can craft a URL containing a colon and userinfo to make the address bar display a trusted domain while actually loading a malicious site. This UI misrepresentation can facilitate phishing attacks by misleading users about the true website they are visiting. Red Hat has assessed that this vulnerability does not affect any currently supported Red Hat products.
A flaw was found in the file-sgi plugin in GIMP. When processing an RLE-compressed SGI image, the plugin allocates memory for a row table. The image header dimensions (ysize and zsize) are read as 16-bit unsigned integers. If a crafted file sets both dimensions to their maximum value (65535), the multiplication ysize * zsize overflows the standard 32-bit int boundary before being passed to calloc. This integer overflow issue results in undefined behavior, aborting the plugin and causing a denial of service.
A flaw was found in the file-icns plugin in GIMP. When applying a decompressed mask during ICNS image processing, the plugin reads from the mask data buffer without verifying if the cursor exceeds the allocated resource size. If a crafted file contains a truncated mask resource, the icns_decompress function continues reading past the bounds of the buffer. This out-of-bounds read vulnerability results in information disclosure of heap contents, where memory contents are leaked as alpha channel pixel values, or a crash leading to a denial of service if unmapped memory is accessed.
A flaw was found in the file-fits plugin in GIMP. When processing a FITS image file, the plugin calculates memory allocation sizes using signed 32-bit integers for width and height. If a crafted file sets both values to large values, their product exceeds 2^31 and overflows, resulting in an undersized heap-based buffer allocation. This integer overflow issue results in a heap-based buffer overflow when cfitsio subsequently writes a full row of pixels in the buffer, causing memory corruption, potentially leading to arbitrary code execution or a denial of service.
CVE-2026-16768 is a medium severity vulnerability in the GNOME gdk-pixbuf library. It involves an out-of-bounds read when parsing specially crafted ICO files with pixel values exceeding the palette range. This flaw allows heap memory content to be leaked via the generated image output, such as thumbnails. The attacker must supply a crafted ICO file to an application using gdk-pixbuf. The impact is limited to information disclosure without integrity or availability effects. No known exploits are reported. Mitigation includes disabling ICO file support if not needed.
A flaw was found in librest. The PKCE implementation for OAuth authorization uses the GRand function from the GLib API, a cryptographically insecure pseudo-random number generator. Because the generated "code verifier" lacks sufficient cryptographic entropy, a malicious actor can reverse-engineer the pseudo-random number generator (PRNG) seed to predict or reconstruct the code verifier string, allowing an attacker to bypass PKCE protections and successfully impersonate the client during the OAuth 2.0 authorization flow.
A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a `node` element nested within other elements like `method`, `signal`, `property` or `arg`. This issue can cause an unsigned integer overflow and lead to an out-of-bounds read, resulting in a denial of service.
A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context parameter received from the server. A malicious D-Bus server can supply a cookie_context containing path traversal sequences, causing the client to read an arbitrary file and exfiltrate sensitive data by verifying guessed file contents against a generated hash.
A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary.
A flaw was found in GLib. A buffer over-read can occur in g_io_channel_read_line_backend() in the giochannel.c file when a custom line terminator with a length greater than one is set, causing memcmp to read past the GString buffer. This vulnerability can cause a minor information disclosure of 7 bytes or a denial of service when the buffer over-read crosses a page boundary.
A flaw was found in GLib. A buffer over-read can occur in the g_regex_replace function when used with the `G_REGEX_RAW` compile flag and case-change replacement escapes because the string_append function processes matched substrings using UTF-8 functions that assume valid UTF-8 input, even when the string is treated as raw bytes. This vulnerability can cause a minor information disclosure of 1-5 bytes and a denial of service when the buffer over-read crosses a page boundary.
A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the g_date_time_get_ymd function in the glib/gdatetime.c file when an invalid GDateTime object produced by the g_date_time_add_full function is processed. This flaw can corrupt the date output and potentially cause logic errors that may lead to a denial of service.
A flaw was found in GLib. An off-by-one error can occur in the gvs_tuple_is_normal function in the glib/gvariant-serialiser.c file when doing an alignment padding check because the bounds check uses > instead of >=, causing an out-of-bounds read of only 1 byte. This issue can cause a minor information disclosure of 1 byte and a denial of service when the out-of-bounds read crosses a page boundary.