Executive brief
GIMP is a popular open-source image editing application used by graphics professionals and designers. A flaw in its XWD image file handler allows attackers to craft malicious image files that trigger improper memory validation. An attacker can exploit this by sending a specially crafted image file to a user, causing GIMP to crash or potentially leak sensitive data from the application's memory.
Technical details
The vulnerability is a heap out-of-bounds read in GIMP's file-xwd plugin caused by insufficient validation of XWD image parameters. The plugin validates the image width and bytes-per-line parameters independently without ensuring their combined values are consistent with the allocated buffer size, leading to improper bounds checking. The attack vector is local and requires user interaction (opening a malicious XWD file). An attacker can trigger an application crash (denial of service) or potentially disclose limited heap memory contents. The vulnerability requires GIMP to be run and a user to open a specially crafted XWD file.
Affected products
- GNOME GIMP <UNKNOWN>
Timeline
- 2026-08-25: disclosed