Executive brief
GIMP, a popular open-source image editor, is vulnerable to a security flaw when processing certain high-dynamic-range (HDR) image files. If a user is tricked into opening a specially crafted malicious HDR file, an attacker could take control of the application and execute unauthorized commands on the user's computer. This could lead to the theft of personal data or a full system compromise depending on the user's permissions.
Technical details
A heap-based buffer overflow exists in GIMP's HDR file parsing logic, specifically within the GEGL (Generic Graphics Library) component. The flaw is located in the `rgbe_read_new_rle` function in `rgbe.c`, where the application fails to validate the length of user-supplied Run-Length Encoding (RLE) data before copying it into a heap buffer. An attacker can exploit this by providing a crafted HDR file with manipulated length values, leading to an out-of-bounds write. Successful exploitation requires a user to open the malicious file and can result in arbitrary code execution within the context of the GIMP process.
Affected products
- GIMP GIMP 3.2.0-RC1
Timeline
- 2025-12-24: disclosed: Vulnerability reported to vendor
- 2026-03-16: patched: GIMP issued an update to correct the vulnerability
- 2026-03-16: advisory: Coordinated public release of advisory ZDI-26-214
- 2026-06-10: other: NVD publication date