Threats Tagged 'cve-2026-66758'

Multiple security vulnerabilities have been identified in GIMP 2.8, including stack buffer overflows, integer overflows, and heap-based buffer overflows in various image file parsers such as TIF, PSD, FITS, and SGI. These vulnerabilities could allow remote code execution when processing crafted image files. Red Hat has issued an important security update for GIMP 2.8 on Red Hat Enterprise Linux 8 to address these issues.

The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo. Security Fix(es): * gimp: GIMP APNG loader heap-buffer-overflow when fcTL width exceeds IHDR width (file-png.c) (CVE-2026-42169) * gimp: integer overflow in file-fits plugin causes a heap-based buffer overflow on crafted FITS images (CVE-2026-66758) * gimp: out-of-bounds read in file-icns plugin causes information disclosure or crash on crafted ICNS images (CVE-2026-66759) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

CVE-2026-66758 is a high-severity integer overflow vulnerability in the file-fits plugin of GNOME GIMP. The flaw occurs when processing crafted FITS image files with large width and height values, causing a signed 32-bit integer overflow during memory allocation size calculation. This results in an undersized heap buffer, leading to a heap-based buffer overflow when pixel data is written, potentially causing memory corruption and enabling arbitrary code execution or denial of service. Red Hat has released security updates for GIMP in Red Hat Enterprise Linux 8 and 9 to address this issue.

A flaw was found in the file-fits plugin in GIMP. When processing a FITS image file, the plugin calculates memory allocation sizes using signed 32-bit integers for width and height. If a crafted file sets both values to large values, their product exceeds 2^31 and overflows, resulting in an undersized heap-based buffer allocation. This integer overflow issue results in a heap-based buffer overflow when cfitsio subsequently writes a full row of pixels in the buffer, causing memory corruption, potentially leading to arbitrary code execution or a denial of service.