Executive brief
A vulnerability was found in GIMP, a popular open-source image editor, specifically within its plugin for handling Apple Icon Image (ICNS) files. By tricking a user into opening a specially crafted icon file, an attacker can cause the application to crash or potentially leak sensitive information from the computer's memory. This could lead to a disruption of work or the exposure of data that was previously handled by other applications on the system.
Technical details
An out-of-bounds read vulnerability exists in the icns_decompress() function within GIMP's file-icns-load.c. The flaw occurs because the plugin fails to verify if the mask data cursor exceeds the allocated resource size when applying a decompressed mask. An attacker can provide a crafted .icns file containing a truncated mask resource, causing the loop to read past the buffer bounds. This results in heap information disclosure, where memory contents are leaked as alpha channel pixel values in the displayed image, or a denial-of-service (SIGSEGV) if the read reaches unmapped memory. This vulnerability is distinct from previous fixes in the same component.
Affected products
- GNOME GIMP 2.99.14 and newer, including 3.0.8 and 3.2.4
- Red Hat Red Hat Enterprise Linux 6 affected status
- Red Hat Red Hat Enterprise Linux 7 affected status
- Red Hat Red Hat Enterprise Linux 8 (gimp:2.8/gimp) affected status
- Red Hat Red Hat Enterprise Linux 9 affected status
Timeline
- 2026-06-29: other: Vulnerability reported to GNOME GitLab
- 2026-07-27: disclosed: CVE published and Red Hat advisory issued