CVE-2026-78475 in GIMP
Summary
by MITRE • 08/24/2026
A flaw was found in the file-pix (ESM) plugin in GIMP. When processing a specially crafted PIX image file, the plugin allocates a Variable-Length Array (VLA) on the stack without proper bounds checking, causing an unbounded stack allocation followed by a 21-byte stack over-read. This can result in a denial of service due to stack exhaustion and a limited information disclosure of stack memory contents into an intermediate file.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/24/2026
The vulnerability identified within the GIMP application specifically targets the ESM (ESM) plugin, which is responsible for handling PIX image files. The core technical flaw resides in how the plugin manages memory allocation during the processing of input data. When a specially crafted PIX file is processed, the software attempts to allocate a Variable-Length Array on the stack based on dimensions or parameters derived directly from the file header without performing adequate bounds checking. This lack of validation allows an attacker to supply values that result in excessively large array sizes, leading to unbounded stack allocation. In many modern compiler configurations and operating systems, excessive stack usage can quickly exhaust the available stack space allocated for a thread or process, triggering a stack overflow condition that typically results in immediate application termination.
Beyond the denial of service aspect caused by stack exhaustion, this flaw presents a more subtle but significant risk related to information disclosure. The processing logic involves reading data from the crafted file into memory structures that may extend beyond the intended boundaries due to the improper allocation and subsequent operations. Specifically, the vulnerability allows for a twenty-one-byte over-read on the stack. This means that after copying or accessing the expected data, the application continues to read additional bytes from adjacent memory locations on the stack. These adjacent locations often contain sensitive runtime information such as return addresses, saved frame pointers, local variables of other functions, and potentially cryptographic keys or session tokens if they reside in nearby stack frames.
The operational impact of this vulnerability is twofold. First, it enables a remote denial of service attack against users who open maliciously crafted PIX files within GIMP. Since GIMP is widely used for image editing, an attacker could distribute such files via email attachments or web downloads to trigger crashes in victim systems. Second, the limited information disclosure poses a risk to system stability and security posture. While twenty-one bytes may seem small, this data can be written into intermediate temporary files created by GIMP during processing. If these temporary files are not securely managed or if their contents are exposed through subsequent application behavior, an attacker could potentially leverage this leaked stack memory content for further exploitation attempts, such as bypassing stack-based protections like ASLR (Address Space Layout Randomization) in more complex attack chains involving other vulnerabilities.
From a classification perspective, this vulnerability aligns with CWE-121, which describes a stack buffer overflow caused by unbounded copy of data from an input source to a destination on the stack. Additionally, it relates to CWE-787, where out-of-bounds write or read occurs due to improper boundary validation. In terms of adversary tactics, this flaw supports techniques associated with reconnaissance and privilege escalation in the MITRE ATT&CK framework, particularly those involving memory scraping or information gathering from local system resources. The exploitation vector is generally classified as an input-driven vulnerability, requiring user interaction such as opening a file, which places it within the context of CWE-20 Improper Input Validation.
Mitigation strategies for this issue primarily involve updating to patched versions of GIMP where the ESM plugin has been modified to enforce strict bounds checking on all array dimensions derived from external input files. Developers must ensure that any variable-length allocations are validated against maximum allowable limits defined by system constraints or application logic before allocation occurs. Furthermore, implementing stack canaries and enabling compiler flags such as -fstack-protector-strong can help detect and prevent exploitation of stack-based overflows at runtime. For end-users, the immediate mitigation is to avoid opening PIX files from untrusted sources until a patch is available. System administrators should also ensure that temporary file permissions are restricted to limit the potential impact of any information leakage into intermediate storage locations.