Executive brief
GIMP is a popular open-source image editor used for professional photo retouching and image composition. A security flaw in how the application handles HDR image files could allow an attacker to take control of a user's computer if the user is tricked into opening a specially crafted malicious file. This could lead to the theft of personal data, unauthorized access to files, or the installation of further malware.
Technical details
A heap-based buffer overflow exists within GIMP's HDR file parsing logic, specifically in the GEGL component's 'rgbe_read_new_rle' function. The vulnerability is caused by a lack of proper validation of user-supplied run-length data before it is copied into a heap buffer. An attacker can exploit this by providing a crafted HDR file that specifies a run length exceeding the remaining buffer capacity. Successful exploitation requires user interaction (opening the file) and allows for arbitrary code execution in the context of the current process. A fix has been developed in the GEGL library to ensure run lengths do not exceed available space.
Affected products
- GIMP GIMP 3.0.6
Timeline
- 2025-12-04: disclosed: Vulnerability reported to vendor
- 2026-04-15: advisory: Coordinated public release of advisory
- 2026-06-24: other: NVD publication date