# CVE-2026-90948: Gimp: gimp: heap-based buffer overflow in ico loader via integer overflow in embedded png dimensions

Status: published. Published: 2026-09-14. Updated: 2026-11-02.

A flaw was found in GIMP's ICO file loader. When processing an ICO file containing an embedded PNG image, an integer overflow can occur during the calculation of the required buffer size. This leads to an undersized buffer being allocated, causing a heap-based buffer overflow when the decoded pixel data is written. A remote attacker could exploit this by crafting a malicious ICO file, which, when opened, could lead to arbitrary code execution or a crash.

## Remediation

- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. (source: CNA: redhat)

## Affected products and versions

- Red Hat / Red Hat Enterprise Linux 8 (gimp:2.8): ≥ 8100020261015094823.4c9c024f; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 9 (gimp): ≥ 2:3.0.4-4.el9_8.14; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions (gimp): ≥ 2:2.99.8-4.el9_2.7; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 6 (gimp): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 7 (gimp): Version range not reported. Source: CNA: redhat

## Severity and prioritization

- CVSS 3.1: 7.8 (high); CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; source: CNA: redhat

- CVSS 3.1: 7.8 (high); CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; source: NVD: secalert@redhat.com

- CISA KEV: No listing in collected sources

- EPSS: 0.23% as of 2026-11-01; percentile 13.57%

- SSVC: exploitation none; automatable no; technical impact total; source ADP: CISA-ADP

- Weaknesses: CWE-787

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://access.redhat.com/errata/RHSA-2026:75575 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:84744 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:93589 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/security/cve/CVE-2026-90948 (CNA: redhat; vdb-entry, x_refsource_REDHAT)

- https://bugzilla.redhat.com/show_bug.cgi?id=2533008 (CNA: redhat; issue-tracking, x_refsource_REDHAT)

- https://gitlab.gnome.org/GNOME/gimp/-/work_items/16742 (CNA: redhat)

- https://access.redhat.com/errata/RHSA-2026:75575 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2026:84744 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2026:93589 (secalert@redhat.com)

- https://access.redhat.com/security/cve/CVE-2026-90948 (secalert@redhat.com)

- https://bugzilla.redhat.com/show_bug.cgi?id=2533008 (secalert@redhat.com)

- https://gitlab.gnome.org/GNOME/gimp/-/work_items/16742 (secalert@redhat.com)

## Provenance

- CNA: redhat: https://www.cve.org/CVERecord?id=CVE-2026-90948; retrieved 2026-11-02; source updated 2026-11-02

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-90948; retrieved 2026-11-02; source updated 2026-11-02

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-90948; retrieved 2026-11-02; source updated Not reported

Revision: 669853a19388f1679510b6fc122bb4a4364250207ab1651939f77c6efb1e0ab8

Canonical: https://y2.dev/cve/CVE-2026-90948