Gimp: signed integer overflow in file-sgi (sgi-lib) causes the plugin to crash on rle sgi images
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Deferred Red Hat: fix deferred
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-190 and the CVSS impact.
Summary
A flaw was found in the file-sgi plugin in GIMP. When processing an RLE-compressed SGI image, the plugin allocates memory for a row table. The image header dimensions (ysize and zsize) are read as 16-bit unsigned integers. If a crafted file sets both dimensions to their maximum value (65535), the multiplication ysize * zsize overflows the standard 32-bit int boundary before being passed to calloc. This integer overflow issue results in undefined behavior, aborting the plugin and causing a denial of service.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| GNOME | GIMP | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 6 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 7 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | — | No fix listed | CNA |
- GIMP VendorGNOME Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 6 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:gimp:gimp:3.2.6:*:*:*:*:*:*:* | 3.2.6 | Vulnerable | GIMP |
| cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Red Hat |
- cpe:2.3:a:gimp:gimp:3.2.6:*:*:*:*:*:*:* Versions 3.2.6 Vulnerable ·GIMP
- cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-66757
- 2026-10-03 Alias added: GHSA-3xfh-g29g-69hj
References
More GNOME vulnerabilities
- TI-2023-23091 Gnome-maps: gnome maps is vulnerable to a code injection attack (similar to xss) via its service.json CVSS 3.1CRITICAL 9.8
- TI-2026-41775 Glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list" CVSS 3.1HIGH 8.6
- TI-2026-41772 Glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid gdatetime CVSS 3.1HIGH 7.5
- TI-2026-03716 Libsoup: libsoup: denial of service via use-after-free in http/2 server CVSS 3.1HIGH 7.5
- TI-2024-28393 Integer overflow in GNOME G Structured File Library CVSS 3.1HIGH 8.4
- TI-2024-24253 Integer overflow in GNOME G Structured File Library CVSS 3.1HIGH 8.4
Sources
- CVE-2026-66757 · CVE Program
- CVE-2026-66757 · NVD
- FIRST EPSS
- GHSA-3xfh-g29g-69hj · GitHub Advisory Database · CC BY 4.0
- CVE-2026-66757 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences