Executive brief
GIMP is a widely-used image editing program that processes various image formats including Animated PNG (APNG) files. A heap-buffer-overflow vulnerability exists in the APNG loader when a specially crafted image file has an fcTL width parameter that exceeds the IHDR width, causing pixel data to be written past allocated memory. An attacker can exploit this by distributing a malicious APNG image file that, when opened by a user in GIMP, could lead to arbitrary code execution and full system compromise.
Technical details
A heap-buffer-overflow vulnerability exists in GIMP's APNG file loader (file-png.c) due to insufficient validation of the fcTL (frame control) chunk width parameter against the IHDR (image header) width. When the fcTL width exceeds the IHDR width, the loader writes pixel data beyond the bounds of an allocated heap buffer. The vulnerability is triggered by opening a specially crafted APNG file in GIMP and requires no special privileges or authentication. Successful exploitation can lead to memory corruption and arbitrary code execution with the privileges of the user running GIMP. A patch is available in GIMP version 3.0.4-4.el9_8.9 and later.
Affected products
- GIMP GIMP before 3.0.4
Timeline
- 2026-08-04: disclosed
- 2026-08-05: advisory: Red Hat Security Advisory RHSA-2026:50817 issued