# CVE-2026-2044: GIMP uninitialized memory remote code execution in PGM parsing

Source: https://junglewise.ai/threats/cve-2026-2044-gimp-uninitialized-memory-remote-code-execution-in-pgm-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-20. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-2044 · Severity: high · CVSS 8.8 · Published 2026-02-20

GIMP is a widely used open-source image editor for professional photo retouching and image composition. A security vulnerability has been identified in how the application handles PGM image files, which could allow an attacker to take control of a user's computer. To exploit this, an attacker would need to trick a user into opening a specially crafted malicious image file or visiting a compromised website.

Technologies: [Gimp](https://junglewise.ai/threats/technologies/gimp). Vendors: [Gimp](https://junglewise.ai/threats/vendors/gimp).

## Quick answers

**Is CVE-2026-2044 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-2044 being exploited in the wild.

**How severe is CVE-2026-2044?** High severity, with a CVSS score of 8.8, published 20 February 2026.

**Which products and versions are affected?** GNOME GIMP 2.8.22, 3.0.4; Red Hat Enterprise Linux 8, 9.

**Is there a fix for CVE-2026-2044?** A patch was published on 2025-12-05: Fix merged into GNOME GIMP master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-2044 attacked?** It is attacked over the network or with local access, in a network appliance.

**Am I affected by CVE-2026-2044?** Check whether you run Gimp. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability (CWE-908) exists in GIMP's PGM (Portable Graymap) file parsing logic due to the use of uninitialized memory. Specifically, the application used 'g_malloc' instead of 'g_malloc0' when allocating memory for file parsing, leading to the use of unpredictable data from previous allocations. An attacker can craft a malicious PGM file that, when opened by a user, triggers this flaw to achieve remote code execution in the context of the GIMP process. The vulnerability was addressed by switching to zero-initialized memory allocation. Red Hat has released updates for RHEL 8 and 9 to mitigate this issue.

## Affected products

- GNOME GIMP 2.8.22, 3.0.4
- Red Hat Enterprise Linux 8, 9

## Timeline

- 2025-11-11: disclosed: Vulnerability reported to vendor via ZDI
- 2025-12-05: patched: Fix merged into GNOME GIMP master branch
- 2026-02-19: advisory: ZDI published advisory ZDI-26-118
- 2026-03-10: patched: Red Hat released security updates for RHEL 9

## References

- [https://gitlab.gnome.org/GNOME/gimp/-/merge_requests/2569/diffs?commit_id=112a5e038f0646eae5ae314988ec074433d2b365](https://gitlab.gnome.org/GNOME/gimp/-/merge_requests/2569/diffs?commit_id=112a5e038f0646eae5ae314988ec074433d2b365)
- [https://www.zerodayinitiative.com/advisories/ZDI-26-118/](https://www.zerodayinitiative.com/advisories/ZDI-26-118/)
- [https://access.redhat.com/errata/RHSA-2026:4173](https://access.redhat.com/errata/RHSA-2026:4173)
- [https://access.redhat.com/errata/RHSA-2026:5113](https://access.redhat.com/errata/RHSA-2026:5113)
- [https://access.redhat.com/errata/RHSA-2026:5388](https://access.redhat.com/errata/RHSA-2026:5388)
- [https://access.redhat.com/errata/RHSA-2026:5389](https://access.redhat.com/errata/RHSA-2026:5389)
- [https://access.redhat.com/errata/RHSA-2026:5390](https://access.redhat.com/errata/RHSA-2026:5390)

## Related threats

- [GIMP use-after-free in XCF path loader](https://junglewise.ai/threats/cve-2026-112261-a-flaw-was-found-in-gimp-opening-a-crafted-xcf-that-selects-a)
- [GIMP use-after-free in XCF loader](https://junglewise.ai/threats/cve-2026-112258-a-flaw-was-found-in-gimp-the-xcf-loader-can-leave-a-dangling)
- [GIMP integer overflow in file-pvr plug-in](https://junglewise.ai/threats/cve-2026-62439-a-flaw-was-found-in-gimp-an-integer-overflow-occurs-in-the-file)
- [GIMP heap buffer overflow in raw data export](https://junglewise.ai/threats/cve-2026-106066-a-heap-based-buffer-overflow-was-found-in-gimp-s-raw-data-export)
- [GIMP heap buffer overflow in GIF export](https://junglewise.ai/threats/cve-2026-106064-a-heap-based-buffer-overflow-was-found-in-gimp-s-gif-export-plug)