Executive brief
GIMP's ICO (icon format) file plugin contains a memory validation flaw that can be triggered by opening a maliciously crafted image file. An attacker can exploit this to crash the application, disrupting work and potentially exposing sensitive data from the application's memory to an attacker with local access.
Technical details
The file-ico plugin in GIMP fails to properly validate the used_clrs (palette count) parameter when parsing ICO image files. This improper validation leads to insufficient memory bounds checking, resulting in a heap out-of-bounds read. The vulnerability is triggered when a specially crafted ICO file is opened in GIMP. An attacker must convince a user to open a malicious ICO file (network reachable via file download, or local via file sharing). Successful exploitation results in application crash (denial of service) or limited information disclosure by reading adjacent heap memory contents. Patches are expected from GIMP upstream.
Affected products
- GIMP GIMP <unknown
Timeline
- 2026-08-28: disclosed
- other: CVE-2026-82328 assigned