CVE-2026-78475— Gimp: unbounded stack vla and 21-byte stack over-read in pix (esm) loader
Quick assessment
Affected
GNOME GIMP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
GIMP 的 file-pix（ESM）插件中存在一个漏洞。在处理特制的 PIX 图像文件时，该插件在栈上分配了一个变长数组（VLA），但未进行适当的边界检查，导致栈分配无界，并随后发生 21 字节的栈溢出读取。这可能因栈耗尽而导致拒绝服务（DoS），并可能将栈内存内容有限地泄露到中间文件中。
Possible ATT&CK Techniques 1 AI
T1210 · Exploitation of Remote Services
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-78475
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Gimp: unbounded stack vla and 21-byte stack over-read in pix (esm) loader
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in the file-pix (ESM) plugin in GIMP. When processing a specially crafted PIX image file, the plugin allocates a Variable-Length Array (VLA) on the stack without proper bounds checking, causing an unbounded stack allocation followed by a 21-byte stack over-read. This can result in a denial of service due to stack exhaustion and a limited information disclosure of stack memory contents into an intermediate file.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| GNOME | GIMP | 3.0.0 ~ * | - |
|
| Red Hat | Red Hat Enterprise Linux 6 | - |
cpe:/o:redhat:enterprise_linux:6
|
|
| Red Hat | Red Hat Enterprise Linux 7 | - |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 | - |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 | - |
cpe:/o:redhat:enterprise_linux:9
|
|
II. Public POCs for CVE-2026-78475
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-78475
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-78475 (1)
Vendor Advisories for CVE-2026-78475 (1)
-
🔗 2522072 – (CVE-2026-78475) CVE-2026-78475 gimp: unbounded stack VLA and 21-byte stack over-read in PIX (ESM) loader Read full article issue-tracking x_refsource_REDHAT
Other References for CVE-2026-78475 (1)
IV. Related Vulnerabilities
Same product: GIMP
-
CVE-2026-78465
Gimp: integer overflow in pcx loader (planes=4) leads to hea -
CVE-2026-18309
GIMP APNG File Parsing Integer Overflow Remote Code Executio -
CVE-2026-18308
GIMP TIF File Parsing Integer Overflow Remote Code Execution -
CVE-2026-18307
GIMP TIF File Parsing Heap-based Buffer Overflow Remote Code -
CVE-2026-18306
GIMP SGI File Parsing Integer Overflow Remote Code Execution
Same vendor: GNOME
-
CVE-2026-78465
Gimp: integer overflow in pcx loader (planes=4) leads to hea -
CVE-2026-18487
Epiphany: address bar / host spoofing via userinfo in ephy_u -
CVE-2026-18358
Gnome-remote-desktop: gnome-remote-desktop system-mode rdp s -
CVE-2026-66759
Gimp: out-of-bounds read in file-icns plugin causes informat -
CVE-2026-66757
Gimp: signed integer overflow in file-sgi (sgi-lib) causes t
Same weakness: CWE-125
-
CVE-2026-59189
OpenEXR: Out-of-bounds read in DeepImageChannel::row() for n -
CVE-2026-64203
Out-of-Bounds Read Vulnerability in NI LabVIEW when loading -
CVE-2026-64202
Out-of-Bounds Read Vulnerability in NI LabVIEW when loading -
CVE-2026-64201
Out-of-Bounds Read Vulnerability in NI LabVIEW when loading -
CVE-2026-16234
Out-of-Bounds Read Vulnerability in NI LabVIEW when loading
V. Comments for CVE-2026-78475
No comments yet