Executive brief
GIMP's IFF/ILBM image file handler contains a flaw that allows specially crafted image files to trigger memory read errors. An attacker could crash the application by sending a malicious image file, or potentially leak small amounts of sensitive data from the application's memory. This affects users who open untrusted image files in GIMP.
Technical details
The vulnerability is a heap out-of-bounds read in GIMP's file-iff (IFF/ILBM) plugin. The root cause is improper validation of the HAM row size and incorrect handling of the case where the number of color planes (nPlanes) is zero, resulting in a row size mismatch that bypasses memory bounds checking. The attack vector is network/local (via opening a crafted image file), requires no authentication, and involves user interaction (opening the file). An attacker can achieve denial of service via application crash or limited information disclosure of heap memory contents. Patches should be available from GIMP upstream.
Affected products
- GNOME GIMP <UNKNOWN>
Timeline
- 2026-08-28: disclosed