Junglewise Threat Intelligence

CVE-2026-2048: GNOME GIMP out-of-bounds write in XWD file parsing

CVE-2026-2048 · Severity: high · CVSS 7.8 · Published 2026-02-20

Technologies: Gimp. Vendors: Gimp, Gnome.

Executive brief

A vulnerability in GIMP, a popular open-source image editor, allows an attacker to execute malicious code on a user's computer. This occurs when a user is tricked into opening a specially crafted X Window Dump (XWD) image file. Successful exploitation could lead to a full system compromise, data theft, or the installation of malware in the context of the user's active session.

Technical details

An out-of-bounds (OOB) write vulnerability exists in GIMP's handling of X Window Dump (XWD) files. The flaw is rooted in insufficient validation of user-supplied data during the parsing of XWD headers and pixel data, leading to incorrect pointer arithmetic that exceeds allocated buffer boundaries. An attacker can exploit this by providing a malformed XWD file which, when opened by a user, triggers a heap-based buffer overflow. This allows for arbitrary code execution within the context of the GIMP process. Patches have been released by GNOME and downstream distributors like Red Hat to implement proper bounds checking during memory allocation and data copying.

Affected products

  • GNOME GIMP 3.0.4-1 and earlier; 2.8.22-26 and earlier

Timeline

  • 2025-12-24: disclosed: Vulnerability reported to vendor
  • 2025-12-31: patched: Merge request for security fix submitted to GIMP GitLab
  • 2026-02-19: advisory: Coordinated public release by Zero Day Initiative
  • 2026-03-10: patched: Red Hat released security updates for RHEL 9 (RHSA-2026:4173)

References

Related threats