Threats Tagged 'cve-2026-78475'

Multiple security vulnerabilities affecting GIMP, including remote code execution and arbitrary code execution via crafted image files, have been fixed in the gimp-3.2.6-1.1 package. These issues involve integer overflows, heap-based buffer overflows, and unsigned underflows in PSD, TIF, and SGI file parsing. The vulnerabilities were addressed in updates available for various architectures and distributions, including Red Hat Enterprise Linux 9. No known exploits in the wild have been reported.

These are all security issues fixed in the gimp-3.2.6-1.1 package on the GA media of openSUSE Tumbleweed.

CVE-2026-78475 is a vulnerability in the file-pix (ESM) plugin of GNOME GIMP affecting versions 3.0.0 and later. It involves an out-of-bounds read caused by unbounded stack allocation of a Variable-Length Array (VLA) when processing specially crafted PIX image files. This flaw can lead to denial of service due to stack exhaustion and limited disclosure of stack memory contents. Exploitation requires convincing a user to open a malicious PIX file, reducing the likelihood of attack. The vulnerability has a medium severity rating with a CVSS score of 6.1.