PT-2026-20859 · Gimp+2 · Gimp+2
Zdi
·
Published
2025-12-31
·
Updated
2026-04-24
·
CVE-2026-2048
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
GIMP (affected versions not specified)
Description
A flaw exists in GIMP’s parsing of XWD files, leading to a potential out-of-bounds write. This can allow a remote attacker to execute arbitrary code on systems running affected versions of GIMP. User interaction is required, as the target must open a malicious file or visit a malicious page. The issue stems from insufficient validation of user-supplied data, which can lead to writing beyond the bounds of an allocated buffer. An attacker could exploit this to execute code within the current process.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
RCE
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Gimp
Red Os
Rocky Linux