Executive brief
GIMP's file-pix image plugin contains a flaw that crashes the application when processing specially crafted PIX image files. An attacker who tricks a user into opening a malicious image file can cause GIMP to freeze or crash, disrupting work, and potentially leak small amounts of sensitive data from the application's memory.
Technical details
The vulnerability exists in the file-pix (ESM) plugin in GIMP due to improper bounds checking on a Variable-Length Array (VLA) allocated on the stack. When processing a specially crafted PIX image file, the plugin performs unbounded stack allocation followed by a 21-byte stack over-read. This results in a stack exhaustion condition that causes denial of service and limited information disclosure of stack memory contents into an intermediate file. The attack requires user interaction (opening a malicious PIX file) and affects local GIMP instances.
Affected products
- GNOME GIMP <UNKNOWN>
Timeline
- 2026-08-24: disclosed