Executive brief
A vulnerability exists in GIMP, a popular open-source image editor, specifically within its plugin for handling FITS image files. By tricking a user into opening a specially crafted image file, an attacker can cause the application to crash or potentially execute malicious code on the user's computer. This could lead to a full system compromise or the theft of sensitive data accessible to the user.
Technical details
An integer overflow vulnerability (CWE-190) exists in the 'file-fits' plugin of GIMP within the load_image() function. The plugin uses signed 32-bit integers (gint) to store image width and height; while individual dimensions are checked against GIMP_MAX_IMAGE_SIZE, their product is not validated. When processing a crafted FITS file with large dimensions, the product overflows, resulting in an undersized heap buffer allocation via g_try_malloc(). Subsequent calls to fits_read_pix() from the cfitsio library write full rows of pixel data into this undersized buffer, leading to a heap-based buffer overflow (CWE-122). This can overwrite adjacent heap objects such as GimpImage or GeglBuffer vtable pointers, enabling arbitrary code execution. Exploitation requires a user to open a malicious FITS file.
Affected products
- GNOME GIMP 3.0.8, 3.2.4, master HEAD (f365f17b)
- Red Hat GIMP Enterprise Linux 6, 7, 8, 9
Timeline
- 2026-06-29: other: Vulnerability reported to GNOME GitLab
- 2026-07-27: disclosed: CVE published and Red Hat advisory issued