Y2
Public vulnerability disclosure

CVE-2026-90948

Gimp: gimp: heap-based buffer overflow in ico loader via integer overflow in embedded png dimensions

publishedCWE-787

A flaw was found in GIMP's ICO file loader. When processing an ICO file containing an embedded PNG image, an integer overflow can occur during the calculation of the required buffer size. This leads to an undersized buffer being allocated, causing a heap-based buffer overflow when the decoded pixel data is written. A remote attacker could exploit this by crafting a malicious ICO file, which, when opened, could lead to arbitrary code execution or a crash.

Investigate in Cyber JSONMarkdown
Technical severity7.8 highCVSS 3.1 · CNA: redhat
Published2026-09-14Source updated 2026-11-02
Collected2026-11-022 attributed sources

Fixes and workarounds

Workaround

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

Source: CNA: redhat

Affected products and versions

ProductVersionsAuthority
Red Hat Enterprise Linux 8
Red Hat
gimp:2.8
https://access.redhat.com/downloads/content/package-browser/ 		≥ 8100020261015094823.4c9c024f; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat Enterprise Linux 9
Red Hat
gimp
https://access.redhat.com/downloads/content/package-browser/ 		≥ 2:3.0.4-4.el9_8.14; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
Red Hat
gimp
https://access.redhat.com/downloads/content/package-browser/ 		≥ 2:2.99.8-4.el9_2.7; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat Enterprise Linux 6
Red Hat
gimp
https://access.redhat.com/downloads/content/package-browser/ 		Range not reported
Other versions: unknown 		CNA: redhat
Red Hat Enterprise Linux 7
Red Hat
gimp
https://access.redhat.com/downloads/content/package-browser/ 		Range not reported
Other versions: affected 		CNA: redhat

Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.

CVSS assessments

Version / scoreVectorAuthority
3.1 / 7.8
high		 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCNA: redhat

Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

References