# GIMP vulnerabilities Source: https://junglewise.ai/threats/technologies/gimp Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/gimp.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 72 vulnerabilities in GIMP: 0 in the last 7 days and 32 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-112261, was published on 19 October 2026. 5 vulnerabilities in the last four weeks, down 55% on the four before (11). ## Counts - Last 7 days: 0 - Last 30 days: 5 - Last 90 days: 32 - All time: 72 (0 critical, 0 exploited in the wild) ## About GIMP Free and open-source raster graphics editor for image manipulation and creation. ## Latest GIMP vulnerabilities - [CVE-2026-112261: GIMP use-after-free in XCF path loader](https://junglewise.ai/threats/cve-2026-112261-a-flaw-was-found-in-gimp-opening-a-crafted-xcf-that-selects-a) (high, CVSS 7.8, published 19 Oct 2026) - [CVE-2026-112258: GIMP use-after-free in XCF loader](https://junglewise.ai/threats/cve-2026-112258-a-flaw-was-found-in-gimp-the-xcf-loader-can-leave-a-dangling) (high, CVSS 7.8, published 19 Oct 2026) - [CVE-2026-112257: GIMP heap out-of-bounds access in PSD thumbnail loader](https://junglewise.ai/threats/cve-2026-112257-a-flaw-was-found-in-gimp-the-psd-thumbnail-resource-loader) (high, CVSS 7.8, published 19 Oct 2026) - [CVE-2026-112259: GIMP NULL pointer dereference in SBZ palette import](https://junglewise.ai/threats/cve-2026-112259-a-flaw-was-found-in-gimp-importing-a-crafted-sbz-palette-without) (medium, CVSS 5.5, published 19 Oct 2026) - [CVE-2026-62439: GIMP integer overflow in file-pvr plug-in](https://junglewise.ai/threats/cve-2026-62439-a-flaw-was-found-in-gimp-an-integer-overflow-occurs-in-the-file) (high, CVSS 7, published 16 Oct 2026) - [CVE-2026-108093: GIMP NULL pointer dereference in XCF loader](https://junglewise.ai/threats/cve-2026-108093-a-flaw-was-found-in-gimp-the-xcf-loader-processes-image) (medium, CVSS 5.5, published 9 Oct 2026) - [CVE-2026-106067: GIMP heap buffer overflow in Hot color filter](https://junglewise.ai/threats/cve-2026-106067-a-heap-based-buffer-overflow-was-found-in-gimp-s-hot-color) (medium, CVSS 6.3, published 7 Oct 2026) - [CVE-2026-106066: GIMP heap buffer overflow in raw data export](https://junglewise.ai/threats/cve-2026-106066-a-heap-based-buffer-overflow-was-found-in-gimp-s-raw-data-export) (medium, CVSS 6.3, published 7 Oct 2026) - [CVE-2026-106065: GIMP heap buffer overflow in PCX export](https://junglewise.ai/threats/cve-2026-106065-a-heap-based-buffer-overflow-was-found-in-gimp-s-pcx-export-plug) (medium, CVSS 6.3, published 7 Oct 2026) - [CVE-2026-106064: GIMP heap buffer overflow in GIF export](https://junglewise.ai/threats/cve-2026-106064-a-heap-based-buffer-overflow-was-found-in-gimp-s-gif-export-plug) (medium, CVSS 6.3, published 7 Oct 2026) - [CVE-2026-106061: GIMP heap buffer over-read in XMC thumbnail loader](https://junglewise.ai/threats/cve-2026-106061-a-flaw-was-found-in-gimp-s-x-cursor-xmc-thumbnail-loader-when) (medium, CVSS 5.5, published 7 Oct 2026) - [CVE-2026-106062: GIMP heap buffer overflow in DDS loader](https://junglewise.ai/threats/cve-2026-106062-a-heap-based-buffer-overflow-was-found-in-gimp-s-directdraw) (high, CVSS 7.8, published 6 Oct 2026) - [CVE-2026-106063: GIMP heap buffer overflow in DICOM export](https://junglewise.ai/threats/cve-2026-106063-a-heap-based-buffer-overflow-was-found-in-gimp-s-dicom-export) (medium, CVSS 6.3, published 6 Oct 2026) - [CVE-2026-92248: GIMP file-psd plugin integer overflow in JPEG header parsing](https://junglewise.ai/threats/cve-2026-92248-gimp-file-psd-plugin-integer-overflow-in-jpeg-header-parsing) (high, CVSS 7.8, published 15 Sep 2026) - [CVE-2026-90949: GIMP heap-based buffer overflow in PSP file loader](https://junglewise.ai/threats/cve-2026-90949-gimp-heap-based-buffer-overflow-in-psp-file-loader) (high, CVSS 7.8, published 14 Sep 2026) - [CVE-2026-90948: GIMP ICO file loader heap buffer overflow](https://junglewise.ai/threats/cve-2026-90948-gimp-ico-file-loader-heap-buffer-overflow) (high, CVSS 7.8, published 14 Sep 2026) - [CVE-2026-82343: GIMP file-psd plugin out-of-bounds access in channel validation](https://junglewise.ai/threats/cve-2026-82343-gimp-file-psd-plugin-out-of-bounds-access-in-channel-validation) (medium, CVSS 6.1, published 28 Aug 2026) - [CVE-2026-82330: GIMP file-pvr plugin heap out-of-bounds read in VQ decoder](https://junglewise.ai/threats/cve-2026-82330-gimp-file-pvr-plugin-heap-out-of-bounds-read-in-vq-decoder) (medium, CVSS 6.1, published 28 Aug 2026) - [CVE-2026-82328: GIMP file-ico plugin heap out-of-bounds read](https://junglewise.ai/threats/cve-2026-82328-gimp-file-ico-plugin-heap-out-of-bounds-read) (medium, CVSS 6.1, published 28 Aug 2026) - [CVE-2026-79902: GIMP Seattle FilmWorks plugin stack-based buffer overflow](https://junglewise.ai/threats/cve-2026-79902-gimp-seattle-filmworks-plugin-stack-based-buffer-overflow) (medium, CVSS 5.5, published 26 Aug 2026) - [CVE-2026-78475: GIMP file-pix plugin stack overflow in PIX image processing](https://junglewise.ai/threats/cve-2026-78475-gimp-file-pix-plugin-stack-overflow-in-pix-image-processing) (medium, CVSS 6.1, published 24 Aug 2026) - [CVE-2026-78465: GIMP file-pcx plugin integer overflow in memory allocation](https://junglewise.ai/threats/cve-2026-78465-gimp-file-pcx-plugin-integer-overflow-in-memory-allocation) (high, CVSS 7, published 24 Aug 2026) - [CVE-2026-18309: GIMP integer overflow in APNG file parsing](https://junglewise.ai/threats/cve-2026-18309-gimp-integer-overflow-in-apng-file-parsing) (high, CVSS 7.8, published 20 Aug 2026) - [CVE-2026-18308: GIMP integer overflow in TIF file parsing](https://junglewise.ai/threats/cve-2026-18308-gimp-integer-overflow-in-tif-file-parsing) (high, CVSS 7.8, published 20 Aug 2026) - [CVE-2026-18307: GIMP heap-based buffer overflow in TIF file parsing](https://junglewise.ai/threats/cve-2026-18307-gimp-heap-based-buffer-overflow-in-tif-file-parsing) (high, CVSS 7.8, published 20 Aug 2026) ## Most severe GIMP vulnerabilities - [CVE-2026-0797: GIMP heap-based buffer overflow in ICO file parsing](https://junglewise.ai/threats/cve-2026-0797-gimp-heap-based-buffer-overflow-in-ico-file-parsing) (high, CVSS 8.8, published 20 Feb 2026) - [CVE-2026-2044: GIMP uninitialized memory remote code execution in PGM parsing](https://junglewise.ai/threats/cve-2026-2044-gimp-uninitialized-memory-remote-code-execution-in-pgm-parsing) (high, CVSS 8.8, published 20 Feb 2026) - [CVE-2026-59090: GIMP unsigned integer underflow in PSD file format plugin](https://junglewise.ai/threats/cve-2026-59090-gimp-unsigned-integer-underflow-in-psd-file-format-plugin) (high, CVSS 8.4, published 10 Aug 2026) - [CVE-2025-10925: GIMP ILBM File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows…](https://junglewise.ai/threats/cve-2025-10925-gimp-ilbm-file-parsing-stack-based-buffer-overflow-remote-code) (high, CVSS 7.8, published 29 Oct 2025) - [CVE-2025-10922: GIMP DCM File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote…](https://junglewise.ai/threats/cve-2025-10922-gimp-dcm-file-parsing-heap-based-buffer-overflow-remote-code) (high, CVSS 7.8, published 29 Oct 2025) - [CVE-2026-4152: GIMP JP2 file parsing heap-based buffer overflow](https://junglewise.ai/threats/cve-2026-4152-gimp-jp2-file-parsing-heap-based-buffer-overflow) (high, CVSS 7.8, published 11 Apr 2026) - [CVE-2025-15059: GIMP heap buffer overflow in PSP file parsing](https://junglewise.ai/threats/cve-2025-15059-gimp-heap-buffer-overflow-in-psp-file-parsing) (high, CVSS 7.8, published 23 Jan 2026) - [CVE-2025-14425: GIMP JP2 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote…](https://junglewise.ai/threats/cve-2025-14425-gimp-jp2-file-parsing-heap-based-buffer-overflow-remote-code) (high, CVSS 7.8, published 23 Dec 2025) - [CVE-2025-14424: GIMP XCF File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers…](https://junglewise.ai/threats/cve-2025-14424-gimp-xcf-file-parsing-use-after-free-remote-code-execution) (high, CVSS 7.8, published 23 Dec 2025) - [CVE-2025-14423: GIMP LBM File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows…](https://junglewise.ai/threats/cve-2025-14423-gimp-lbm-file-parsing-stack-based-buffer-overflow-remote-code) (high, CVSS 7.8, published 23 Dec 2025) ## Vulnerabilities per week 5 vulnerabilities in the last four weeks, down 55% on the four before (11). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 10 | 0 | 0 | | 24 Aug 2026 | 6 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 3 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 8 | 0 | 0 | | 12 Oct 2026 | 1 | 0 | 0 | | 19 Oct 2026 | 4 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "GIMP vulnerabilities", https://junglewise.ai/threats/technologies/gimp, 9 November 2026.