Executive brief
A vulnerability in GIMP's SGI image processing plugin allows a specially crafted image file to crash the application. GIMP is a popular open-source image editor used for graphic design and photo manipulation. If a user attempts to open a malicious SGI image, the software will terminate unexpectedly, potentially leading to a loss of unsaved work and a disruption of operations.
Technical details
An integer overflow vulnerability exists in the `file-sgi` plugin of GIMP within `plug-ins/file-sgi/sgi-lib.c`. The flaw occurs when the plugin reads 16-bit unsigned integer dimensions (ysize and zsize) from an RLE-compressed SGI image header. When both values are set to 65535, their multiplication overflows a standard 32-bit signed integer before being passed to `calloc`. This results in undefined behavior and a subsequent abort of the plugin process. An attacker can exploit this by providing a crafted SGI file to a user, resulting in a denial of service (application crash). The issue was confirmed in GIMP version 3.2.4.
Affected products
- GNOME GIMP 3.2.4
- Red Hat Red Hat Enterprise Linux 7
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 9
Timeline
- 2026-07-27: disclosed: Vulnerability reported via Red Hat Bugzilla and GNOME GitLab.
- 2026-07-27: advisory: CVE-2026-66757 published.