Gimp: integer overflow in file-fits plugin causes a heap-based buffer overflow on crafted fits images
Priority LOW 36CWE-190Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 5 fixed, 2 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-190 and the CVSS impact.
Summary
A flaw was found in the file-fits plugin in GIMP. When processing a FITS image file, the plugin calculates memory allocation sizes using signed 32-bit integers for width and height. If a crafted file sets both values to large values, their product exceeds 2^31 and overflows, resulting in an undersized heap-based buffer allocation. This integer overflow issue results in a heap-based buffer overflow when cfitsio subsequently writes a full row of pixels in the buffer, causing memory corruption, potentially leading to arbitrary code execution or a denial of service.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00296 22nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Red Hat: 5 advisoriesRed Hat: 5 fixed, 2 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| GNOME | GIMP | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | 8100020260824165450.4c9c024f | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 2:3.0.4-4.el9_8.9 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | — | 2:2.99.8-4.el9_2.7 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | — | 2:2.99.8-4.el9_4.19 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | — | 2:2.99.8-4.el9_6.20 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 6 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 7 | — | — | No fix listed | CNA |
- GIMP VendorGNOME Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 8100020260824165450.4c9c024f Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 2:3.0.4-4.el9_8.9 Patch available CNA
- Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 2:2.99.8-4.el9_2.7 Patch available CNA
- Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 2:2.99.8-4.el9_4.19 Patch available CNA
- Red Hat Enterprise Linux 9.6 Extended Update Support VendorRed Hat Affected — Fixed in 2:2.99.8-4.el9_6.20 Patch available CNA
- Red Hat Enterprise Linux 6 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:gimp:gimp:3.0.8:*:*:*:*:*:*:* | 3.0.8 | Vulnerable | GIMP |
| cpe:2.3:a:gimp:gimp:3.2.4:*:*:*:*:*:*:* | 3.2.4 | Vulnerable | GIMP |
| cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Red Hat |
- cpe:2.3:a:gimp:gimp:3.0.8:*:*:*:*:*:*:* Versions 3.0.8 Vulnerable ·GIMP
- cpe:2.3:a:gimp:gimp:3.2.4:*:*:*:*:*:*:* Versions 3.2.4 Vulnerable ·GIMP
- cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat
Remediation
Red Hat 5 advisories
- RHSA-2026:93589 Released 2026-11-02 · Red Hat rating Importantgimp security update
- Red Hat Enterprise Linux AppStream E4S (v.9.2) gimp-2:2.99.8-4.el9_2.7, gimp-libs-2:2.99.8-4.el9_2.7
- RHSA-2026:80509 Released 2026-10-12 · Red Hat rating Importantgimp security update
- Red Hat Enterprise Linux AppStream E4S (v.9.4) gimp-2:2.99.8-4.el9_4.19, gimp-libs-2:2.99.8-4.el9_4.19
- RHSA-2026:73768 Released 2026-09-30 · Red Hat rating Importantgimp security update
- Red Hat Enterprise Linux AppStream EUS (v.9.6) gimp-2:2.99.8-4.el9_6.20, gimp-libs-2:2.99.8-4.el9_6.20
Show 2 more Red Hat advisories
- RHSA-2026:62507 Released 2026-09-02 · Red Hat rating Importantgimp:2.8 security update
- Red Hat Enterprise Linux AppStream (v. 8) gimp-2:2.8.22-26.module+el8.10.0+24752+9e6a86ef.8.aarch64::gimp:2.8, gimp-2:2.8.22-26.module+el8.10.0+24752+9e6a86ef.8.ppc64le::gimp:2.8, gimp-2:2.8.22-26.module+el8.10.0+24752+9e6a86ef.8.s390x::gimp:2.8 +47
- RHSA-2026:50817 Released 2026-08-05 · Red Hat rating Importantgimp security update
- Red Hat Enterprise Linux AppStream (v. 9) gimp-2:3.0.4-4.el9_8.9, gimp-libs-2:3.0.4-4.el9_8.9
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 7 | Affected | No fix yet |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2026:62507 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2026:50817 |
| Red Hat Enterprise Linux AppStream E4S (v.9.2) | Fixed | RHSA-2026:93589 |
| Red Hat Enterprise Linux AppStream E4S (v.9.4) | Fixed | RHSA-2026:80509 |
| Red Hat Enterprise Linux AppStream EUS (v.9.6) | Fixed | RHSA-2026:73768 |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-66758
- 2026-10-03 Alias added: GHSA-p2xc-g3qc-p2mq
- 2026-10-12 Fix available: gimp@2:2.99.8-4.el9_4.19 · CNA
- 2026-10-12 1 new reference · CNA
- 2026-10-12 Fix available: RHSA-2026:80509 · Red Hat
- 2026-10-12 Fix available: Red Hat Enterprise Linux AppStream E4S (v.9.4) · Red Hat
- 2026-11-02 Fix available: gimp@2:2.99.8-4.el9_2.7 · CNA
- 2026-11-02 1 new reference · CNA
- 2026-11-02 Fix available: RHSA-2026:93589 · Red Hat
- 2026-11-02 Fix available: Red Hat Enterprise Linux AppStream E4S (v.9.2) · Red Hat
References
More GNOME vulnerabilities
- TI-2023-23091 Gnome-maps: gnome maps is vulnerable to a code injection attack (similar to xss) via its service.json CVSS 3.1CRITICAL 9.8
- TI-2026-41775 Glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list" CVSS 3.1HIGH 8.6
- TI-2026-41772 Glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid gdatetime CVSS 3.1HIGH 7.5
- TI-2026-03716 Libsoup: libsoup: denial of service via use-after-free in http/2 server CVSS 3.1HIGH 7.5
- TI-2024-28393 Integer overflow in GNOME G Structured File Library CVSS 3.1HIGH 8.4
- TI-2024-24253 Integer overflow in GNOME G Structured File Library CVSS 3.1HIGH 8.4
Sources
- CVE-2026-66758 · CVE Program
- CVE-2026-66758 · NVD
- FIRST EPSS
- GHSA-p2xc-g3qc-p2mq · GitHub Advisory Database · CC BY 4.0
- CVE-2026-66758 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences