# CVE-2026-42169: Gimp: gimp apng loader heap-buffer-overflow when fctl width exceeds ihdr width (file-png.c)

Status: published. Published: 2026-08-04. Updated: 2026-11-02.

A heap-buffer-overflow vulnerability exists in the APNG (Animated PNG) file loader of GIMP. This flaw occurs when the `fcTL` width exceeds the `IHDR` width, leading to pixel data being written past the end of a heap allocation. Additionally, a heap-based buffer overflow exists in the DDS plug-in due to a BPP mismatch in the `load_layer()` function. Both vulnerabilities can be triggered by opening a specially crafted image file, potentially leading to code execution.

## Remediation

- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. (source: CNA: redhat)

## Affected products and versions

- Red Hat / Red Hat Enterprise Linux 9 (gimp): ≥ 2:3.0.4-4.el9_8.9; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions (gimp): ≥ 2:2.99.8-4.el9_2.7; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions (gimp): ≥ 2:2.99.8-4.el9_4.19; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 9.6 Extended Update Support (gimp): ≥ 2:2.99.8-4.el9_6.20; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 6 (gimp): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 7 (gimp): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 8 (gimp:2.8/gimp): Version range not reported. Source: CNA: redhat

## NVD configuration conditions

Affected CPE matches depend on the following AND/OR and negation conditions:

```json
[
  {
    "negate": false,
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:redhat:enterprise_linux_eus:9.6:*:*:*:*:*:*:*",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "OR"
  }
]
```

## Severity and prioritization

- CVSS 3.1: 7.3 (high); CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H; source: CNA: redhat

- CVSS 3.1: 7.8 (high); CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; source: NVD: nvd@nist.gov

- CVSS 3.1: 7.3 (high); CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H; source: NVD: secalert@redhat.com

- CISA KEV: No listing in collected sources

- EPSS: 0.13% as of 2026-11-01; percentile 2.82%

- SSVC: exploitation none; automatable no; technical impact total; source ADP: CISA-ADP

- Weaknesses: CWE-131

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://access.redhat.com/errata/RHSA-2026:50817 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:73768 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:80509 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:93589 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/security/cve/CVE-2026-42169 (CNA: redhat; vdb-entry, x_refsource_REDHAT)

- https://bugzilla.redhat.com/show_bug.cgi?id=2461725 (CNA: redhat; issue-tracking, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:50817 (secalert@redhat.com; Issue Tracking)

- https://access.redhat.com/errata/RHSA-2026:73768 (secalert@redhat.com; Issue Tracking)

- https://access.redhat.com/errata/RHSA-2026:80509 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2026:93589 (secalert@redhat.com)

- https://access.redhat.com/security/cve/CVE-2026-42169 (secalert@redhat.com; Vendor Advisory)

- https://bugzilla.redhat.com/show_bug.cgi?id=2461725 (secalert@redhat.com; Issue Tracking, Vendor Advisory)

## Provenance

- CNA: redhat: https://www.cve.org/CVERecord?id=CVE-2026-42169; retrieved 2026-11-02; source updated 2026-11-02

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-42169; retrieved 2026-11-02; source updated 2026-11-02

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-42169; retrieved 2026-11-02; source updated Not reported

Revision: 405145b1345162ea3909700f9e8a611dd9d6323f4d3f360244d2ddc629d35888

Canonical: https://y2.dev/cve/CVE-2026-42169