Executive brief
GIMP is a popular image editor used to create and manipulate digital images. This vulnerability exists in GIMP's handling of TIF image files and allows an attacker to execute arbitrary code on a user's computer by tricking them into opening a malicious image file. The attacker would have complete control over the affected system, potentially allowing theft of sensitive data or installation of malware.
Technical details
A stack-based buffer overflow vulnerability exists in GIMP's TIF file parser due to insufficient validation of user-supplied data length before copying to a stack buffer. The vulnerability is reachable when a user opens a crafted TIF file, either by visiting a malicious web page or directly opening a malicious file. Successful exploitation allows an attacker to execute arbitrary code in the context of the GIMP process with the privileges of the user running GIMP. GIMP has released a patch to address this issue. No active exploitation in the wild has been reported.
Affected products
- GIMP GIMP
Timeline
- 2026-04-17: disclosed: Vulnerability reported to vendor
- 2026-07-29: advisory: Coordinated public release of advisory (ZDI-26-456)
- 2026-07-29: patched: GIMP patch released; see https://gitlab.gnome.org/GNOME/gimp/-/commit/5633b362026c6e5b2beb559a10cd76fa32a47592