Executive brief
GIMP is a widely-used image editing application. This vulnerability exists in GIMP's HDR (High Dynamic Range) image file parser and can allow attackers to execute arbitrary code on a user's computer when they open a malicious HDR file. An attacker could gain full control of the affected system and access sensitive data.
Technical details
The vulnerability is an integer overflow in GIMP's HDR file parsing logic, specifically in how the application validates and processes user-supplied data before allocating buffers. The flaw exists in the parsing of HDR files and results from insufficient validation of input data, leading to an integer overflow that can cause a buffer to be allocated with an incorrect size. The attack vector is local with user interaction required—a target must open a malicious HDR file. An attacker can exploit this to execute arbitrary code in the context of GIMP's process. GIMP has released a patch addressing this issue, as documented in the upstream GEGL repository commit.
Affected products
- GIMP GIMP
Timeline
- 2026-04-17: disclosed: Vulnerability reported to vendor
- 2026-07-29: patched: GIMP issued an update; coordinated public release of advisory
- 2026-07-29: advisory: ZDI-26-453 advisory published