CVE-2026-2045 — Out-of-bounds Write in Debian Gimp

Vendor	Product	Version range	Fixed in
debian	gimp	< gimp 2.10.34-1+deb12u9 (bookworm)	gimp 2.10.34-1+deb12u9 (bookworm)
gimp	gimp	—	—
gimp	gimp	>= 0 < 2.10.22-4+deb11u7	2.10.22-4+deb11u7
gimp	gimp	>= 0 < 2.10.34-1+deb12u9	2.10.34-1+deb12u9
gimp	gimp	>= 0 < 3.0.4-3+deb13u7	3.0.4-3+deb13u7
gimp	gimp	>= 0 < 3.2.0~RC3-1	3.2.0~RC3-1

GHSA

Symfony has Email Header Injection via Non-Token Characters in Mime Parameter Names

ghsa·2026-05-27

CVE-2026-45070 [MEDIUM] CWE-93 Symfony has Email Header Injection via Non-Token Characters in Mime Parameter Names Symfony has Email Header Injection via Non-Token Characters in Mime Parameter Names ### Description `Symfony\Component\Mime\Header\ParameterizedHeader` (and the related parameter handling reachable from `Symfony\Component\Mime\Header\Headers`) is responsible for serializing structured headers such as `Content-Type` and `Content-Disposition`, which carry `key=value` parameters (e.g. `Content-Disposition: attachment; filename="x"`). RFC 2045 / RFC 5322 require parameter *names* to be `tokens`: a restricted ASCII subset that excludes whitespace, CR/LF, and the `tspecials` set. Symfony's parameter handling validates and properly encodes parameter *values*, but does not validate parameter *names*: the supplied name is emitted verbatim into the serialized header. A caller that derives a para

GHSA

GHSA-wx92-h8q5-hfm6: GIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

ghsa_unreviewed·2026-02-21

CVE-2026-2045 [HIGH] CWE-787 GHSA-wx92-h8q5-hfm6: GIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability GIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XWD files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28265.

OSV

CVE-2026-2045: GIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

osv·2026-02-20·CVSS 7.8

CVE-2026-2045 [HIGH] CVE-2026-2045: GIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability GIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XWD files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28265.

Red Hat

gimp: GIMP: Remote Code Execution via out-of-bounds write in XWD file parsing

vendor_redhat·2026-02-20·CVSS 7.8

CVE-2026-2045 [HIGH] CWE-787 gimp: GIMP: Remote Code Execution via out-of-bounds write in XWD file parsing gimp: GIMP: Remote Code Execution via out-of-bounds write in XWD file parsing GIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XWD files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28265. A flaw was found in GIMP. The specific flaw exists within the parsing of XWD files. The

Debian

CVE-2026-2045: gimp - GIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. T...

vendor_debian·2026·CVSS 7.8

CVE-2026-2045 [HIGH] CVE-2026-2045: gimp - GIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. T... GIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XWD files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28265. Scope: local bookworm: resolved (fixed in 2.10.34-1+deb12u9) bullseye: resolved (fixed in 2.10.22-4+deb11u7) forky: resolved (fixed in 3.2.0~RC3-1) sid: resolved (fixed

CVE-2026-2045: GIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected…

Affected

CVSS provenance