Stack buffer overflow in GIMP APNG parsing enables code execution
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-121 and the CVSS impact.
Summary
GIMP versions from 3.2.2 are affected by a stack-based buffer overflow in the parsing of APNG files. The flaw occurs because the length of user-supplied data is not validated before it is copied to a stack buffer, classified as CWE-121. A remote attacker can execute code in the context of the current GIMP process if a user visits a malicious page or opens a malicious file.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
GIMP APNG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of APNG files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29400.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for GIMP. Red Hat lists Red Hat Enterprise Linux 6, 7, 8 and 9 as affected, with no remediation plan available.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix yet |
| Red Hat Enterprise Linux 7 | Affected | No fix yet |
| Red Hat Enterprise Linux 8 | Affected | No fix yet |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
Not affected: 1 product
- Red Hat Enterprise Linux 10
Timeline
- 2026-10-21 Threatist record created from CVE-2026-92183
- 2026-10-21 Alias added: GHSA-x9xp-qfj5-72gg
- 2026-10-22 Affected versions changed · Red Hat
- 2026-10-22 CVSS score added · Red Hat
- 2026-10-23 CISA SSVC decision points changed
- 2026-10-23 Priority changed: MEDIUM → LOW
- 2026-10-23 Affected versions changed · Red Hat
- 2026-10-23 CISA SSVC decision points changed
- 2026-11-07 EPSS moved to the 50th–90th percentile
References
Advisory 1
Other 1
More GIMP vulnerabilities
- TI-2023-23949 Integer overflow in GIMP CVSS 3.0HIGH 7.8
- TI-2026-42270 Gimp: gimp: arbitrary code execution in psd plugin due to unsigned underflow CVSS 3.1CRITICAL 9.9
- TI-2012-02388 Buffer overflow in the readstr_upto function in plug-ins/script-fu/tinyscheme/scheme.c in… CVSS 2.0HIGH 7.5
- TI-2023-23948 Heap-based buffer overflow in GIMP CVSS 3.0HIGH 7.8
- TI-2023-23950 GIMP PSP File Parsing Off-By-One Remote Code Execution Vulnerability CVSS 3.0HIGH 7.8
- TI-2026-54560 Gimp: integer overflow in pcx loader (planes=4) leads to heap overflow on 32-bit CVSS 3.1HIGH 7.0
Sources
- CVE-2026-92183 · CVE Program
- CVE-2026-92183 · NVD
- FIRST EPSS
- GHSA-x9xp-qfj5-72gg · GitHub Advisory Database · CC BY 4.0
- CVE-2026-92183 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences