Y2
Public vulnerability disclosure

CVE-2026-58380

Gimp: gimp: stack buffer overflow in pnmscanner_gettoken()

publishedCWE-193

A flaw was found in GIMP's PNM file format parser. When parsing a specially crafted PNM file, the pnmscanner_gettoken() function writes a null terminator one byte past the end of a stack-allocated buffer due to an off-by-one error in the loop boundary check. This could lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.

Investigate in Cyber JSONMarkdown
Technical severity7.3 highCVSS 3.1 · CNA: redhat
Published2026-07-06Source updated 2026-11-02
Collected2026-11-022 attributed sources

Fixes and workarounds

Workaround

None — requires opening a crafted PNM file.

Source: CNA: redhat

Affected products and versions

ProductVersionsAuthority
Red Hat Enterprise Linux 8
Red Hat
gimp:2.8
https://access.redhat.com/downloads/content/package-browser/ 		≥ 8100020260824165450.4c9c024f; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat Enterprise Linux 9
Red Hat
gimp
https://access.redhat.com/downloads/content/package-browser/ 		≥ 2:3.0.4-4.el9_8.7; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
Red Hat
gimp
https://access.redhat.com/downloads/content/package-browser/ 		≥ 2:2.99.8-4.el9_2.7; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
Red Hat
gimp
https://access.redhat.com/downloads/content/package-browser/ 		≥ 2:2.99.8-4.el9_4.19; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat Enterprise Linux 9.6 Extended Update Support
Red Hat
gimp
https://access.redhat.com/downloads/content/package-browser/ 		≥ 2:2.99.8-4.el9_6.20; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat Enterprise Linux 6
Red Hat
gimp
https://access.redhat.com/downloads/content/package-browser/ 		Range not reported
Other versions: unknown 		CNA: redhat
Red Hat Enterprise Linux 7
Red Hat
gimp
https://access.redhat.com/downloads/content/package-browser/ 		Range not reported
Other versions: affected 		CNA: redhat

Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.

CVSS assessments

Version / scoreVectorAuthority
3.1 / 7.3
high		 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:HCNA: redhat

Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

References