GIMP

Records113All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical7CVSS 9.0–10.0

CVSS high67CVSS 7.0–8.9

Exploited now

GIMP records in CISA KEV

No GIMP vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Gimp 111 records HIGH

Records

111 records in Gimp · all components

TI-2023-23949 CVE-2023-44443 · GHSA-q58r-wxw5-2g3g

Integer overflow in GIMP

HIGH 80

GIMP PSP File Parsing Integer Overflow Remote Code Execution Vulnerability.

CVSS 3.0HIGH 7.8 Local No auth User interaction EPSS 0.93639 Published 2024-05-03 Fixed CWE-190

TI-2026-42270 CVE-2026-59090 · GHSA-gfh5-q868-q4pw

Gimp: gimp: arbitrary code execution in psd plugin due to unsigned underflow

HIGH 76

A flaw was found in GIMP's PSD file format plugin.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.0076 Published 2026-08-10 Partial fix · 2:3.0.4-4.el9_8.10, 2:2.99.8-4.el9_2.7 +2 CWE-191

TI-2012-02388 CVE-2012-2763 · GHSA-9m8q-7xwp-9w66

Buffer overflow in the readstr_upto function in plug-ins/script-fu/tinyscheme/scheme.c in…

HIGH 73

Buffer overflow in the readstr_upto function in plug-ins/script-fu/tinyscheme/scheme.c in GIMP 2.6.12 and earlier, and possibly 2.6.13, allows remote attackers to execute arbitrary code via a long string in a command to…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.81722 Published 2012-07-12 Will not fix CWE-120

TI-2023-23948 CVE-2023-44442 · GHSA-34qx-mf6r-5f7m

Heap-based buffer overflow in GIMP

HIGH 71

GIMP PSD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability.

CVSS 3.0HIGH 7.8 Local No auth User interaction EPSS 0.61167 Published 2024-05-03 Partial fix CWE-122

TI-2023-23950 CVE-2023-44444 · GHSA-w7g8-vmhg-qvwm

GIMP PSP File Parsing Off-By-One Remote Code Execution Vulnerability

HIGH 69

GIMP PSP File Parsing Off-By-One Remote Code Execution Vulnerability.

CVSS 3.0HIGH 7.8 Local No auth User interaction EPSS 0.56129 Published 2024-05-03 Partial fix CWE-193

TI-2026-54560 CVE-2026-78465 · GHSA-944m-78f8-q7cr

Gimp: integer overflow in pcx loader (planes=4) leads to heap overflow on 32-bit

HIGH 66

A flaw was found in the file-pcx plugin in GIMP, affecting 32-bit builds only.

CVSS 3.1HIGH 7.0 Local No auth User interaction EPSS 0.00281 Published 2026-08-24 Will not fix CWE-190

TI-2026-47407 CVE-2026-66759 · GHSA-2gmh-5658-rrq3

Gimp: out-of-bounds read in file-icns plugin causes information disclosure or crash on crafted icns images

MEDIUM 64

A flaw was found in the file-icns plugin in GIMP.

CVSS 3.1HIGH 7.1 Local No auth User interaction EPSS 0.00305 Published 2026-07-27 Fixed in 2:3.0.4-4.el9_8.9 CWE-125

TI-2026-01917 CVE-2026-2272 · GHSA-8g7q-m2xj-67ch

Gimp: gimp: memory corruption due to integer overflow in ico file handling

MEDIUM 62

A flaw was found in GIMP.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00871 Published 2026-03-26 Fix deferred CWE-190

TI-2025-04914 CVE-2025-5473 · GHSA-23w7-3gw5-5jqr

Integer overflow in GIMP

MEDIUM 61

GIMP ICO File Parsing Integer Overflow Remote Code Execution Vulnerability.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.25043 Published 2025-06-06 Partial fix CWE-190

TI-2026-56778 CVE-2026-82330 · GHSA-jf24-j29f-vrgj

Gimp: heap out-of-bounds read in pvr vq (compressed) decoder due to missing bounds check

MEDIUM 60

A flaw was found in the file-pvr plugin in GIMP.

CVSS 3.1MEDIUM 6.1 Local No auth User interaction EPSS 0.00264 Published 2026-08-28 No fix listed CWE-125

TI-2026-56776 CVE-2026-82328 · GHSA-q72j-h9qm-329m

Gimp: heap out-of-bounds read in ico loader via unvalidated used_clrs palette count

MEDIUM 60

A flaw was found in the file-ico plugin in GIMP.

CVSS 3.1MEDIUM 6.1 Local No auth User interaction EPSS 0.00184 Published 2026-08-28 Fix deferred CWE-125

TI-2026-55275 CVE-2026-79902 · GHSA-7m98-q7f5-f6rr

Gimp: stack vla size underflow denial of service in seattle

MEDIUM 58

A flaw was found in the Seattle FilmWorks plugin in GIMP.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.00266 Published 2026-08-26 No fix listed CWE-190

TI-2026-47405 CVE-2026-66757 · GHSA-3xfh-g29g-69hj

Gimp: signed integer overflow in file-sgi (sgi-lib) causes the plugin to crash on rle sgi images

MEDIUM 58

A flaw was found in the file-sgi plugin in GIMP.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.00233 Published 2026-07-27 Fix deferred CWE-190

TI-2026-42269 CVE-2026-59089 · GHSA-7v2w-74r7-8rq2

Gimp: gimp: denial of service via integer overflow in playstation tim loader

MEDIUM 58

A flaw was found in GIMP.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.00317 Published 2026-07-06 Fix deferred CWE-190

TI-2023-23947 CVE-2023-44441 · GHSA-mh5h-w46h-67mh

Heap-based buffer overflow in GIMP

MEDIUM 58

GIMP DDS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability.

CVSS 3.0HIGH 7.8 Local No auth User interaction EPSS 0.27307 Published 2024-05-03 Fixed CWE-122

TI-2026-55366 CVE-2026-80101 · GHSA-r338-8qhf-wvrr

Gimp: multiple heap out-of-bounds reads in xwd loader from unrelated width and bytes-per-line validation

MEDIUM 54

A flaw was found in the file-xwd plugin in GIMP.

CVSS 3.1MEDIUM 4.4 Local No auth User interaction EPSS 0.00234 Published 2026-08-25 Fix deferred CWE-125

TI-2025-02412 CVE-2025-2760 · GHSA-q89g-m3mc-fgwc

Integer overflow in GIMP

MEDIUM 53

GIMP XWD File Parsing Integer Overflow Remote Code Execution Vulnerability.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.17186 Published 2025-04-23 No fix listed CWE-190

TI-2009-03712 CVE-2009-3909 · GHSA-7456-jpq8-24rh

Integer overflow in the read_channel_data function in plug-ins/file-psd/psd-load.c in…

MEDIUM 51

Integer overflow in the read_channel_data function in plug-ins/file-psd/psd-load.c in GIMP 2.6.7 might allow remote attackers to execute arbitrary code via a crafted PSD file that triggers a heap-based buffer overflow.

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.08689 Published 2009-11-19 Partial fix CWE-190

TI-2009-01486 CVE-2009-1570 · GHSA-433f-rgxw-j2rj

Integer overflow in the ReadImage function in plug-ins/file-bmp/bmp-read.c in GIMP 2.6.7…

MEDIUM 51

Integer overflow in the ReadImage function in plug-ins/file-bmp/bmp-read.c in GIMP 2.6.7 might allow remote attackers to execute arbitrary code via a BMP file with crafted width and height values that trigger a heap-base…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.08039 Published 2009-11-13 Fixed CWE-190

TI-2010-04271 CVE-2010-4541 · GHSA-q452-qm55-v79x

Stack-based buffer overflow in the loadit function in plug-ins/common/sphere-designer.c…

MEDIUM 50

Stack-based buffer overflow in the loadit function in plug-ins/common/sphere-designer.c in the SPHERE DESIGNER plugin in GIMP 2.6.11 allows user-assisted remote attackers to cause a denial of service (application crash)…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.06812 Published 2011-01-07 Fixed CWE-787

TI-2010-04273 CVE-2010-4543 · GHSA-6cq7-qh8g-jvqf

Heap-based buffer overflow in the read_channel_data function in file-psp.c in the Paint…

MEDIUM 49

Heap-based buffer overflow in the read_channel_data function in file-psp.c in the Paint Shop Pro (PSP) plugin in GIMP 2.6.11 allows remote attackers to cause a denial of service (application crash) or possibly execute ar…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.16273 Published 2011-01-07 Fixed CWE-787

TI-2009-00698 CVE-2009-0733 · GHSA-mm82-c2wc-w6j7

Multiple stack-based buffer overflows in the ReadSetOfCurves function in LittleCMS (aka…

MEDIUM 48

Multiple stack-based buffer overflows in the ReadSetOfCurves function in LittleCMS (aka lcms or liblcms) before 1.18beta2, as used in Firefox 3.1beta, OpenJDK, and GIMP, allow context-dependent attackers to execute arbit…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.05534 Published 2009-03-23 Fixed CWE-787

TI-2009-00690 CVE-2009-0723 · GHSA-98mq-jm9g-w68j

Multiple integer overflows in LittleCMS (aka lcms or liblcms) before 1.18beta2, as used…

MEDIUM 48

Multiple integer overflows in LittleCMS (aka lcms or liblcms) before 1.18beta2, as used in Firefox 3.1beta, OpenJDK, and GIMP, allow context-dependent attackers to execute arbitrary code via a crafted image file that tri…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.05027 Published 2009-03-23 Fixed CWE-190

TI-2007-02274 CVE-2007-2356 · GHSA-8fv7-cr78-jp82

Stack-based buffer overflow in the set_color_table function in sunras.c in the SUNRAS…

MEDIUM 46

Stack-based buffer overflow in the set_color_table function in sunras.c in the SUNRAS plugin in Gimp 2.2.14 allows user-assisted remote attackers to execute arbitrary code via a crafted RAS file.

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.15674 Published 2007-04-30 Fixed CWE-787

TI-2026-01702 CVE-2026-2045 · GHSA-wx92-h8q5-hfm6

Out-of-bounds write in GIMP

MEDIUM 44

GIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.

CVSS 3.0HIGH 7.8 Local No auth User interaction EPSS 0.05287 Published 2026-02-20 Partial fix CWE-787

Open these records in search →

Critical	7
High	67
Medium	39
Low	0
No CVSS	0