CVE-2026-2047 — Heap-based Buffer Overflow in Gimp

Vendor	Product	Version range	Fixed in
debian	gimp	< gimp 3.2.0~RC3-1 (forky)	gimp 3.2.0~RC3-1 (forky)
gimp	gimp	—	—
gimp	gimp	>= 0 < 3.0.4-3+deb13u7	3.0.4-3+deb13u7
gimp	gimp	>= 0 < 3.2.0~RC3-1	3.2.0~RC3-1
wwbn	avideo	0 – 26.0	—

GitLab

Inefficient Algorithmic Complexity in hMailServer

vendor_gitlab·2026-10-08·CVSS 6.5

CVE-2026-107580 [MEDIUM] CWE-407 Inefficient Algorithmic Complexity in hMailServer Inefficient Algorithmic Complexity in hMailServer Inefficient algorithmic complexity in the decoding of message header fields in Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote unauthenticated attacker to make the IMAP, SMTP and POP3 services, or the webmail, unavailable by sending a message. The server unfolded a decoded header value by finding each line break from the end of the value and removing it, moving the rest of the value each time, so its work grew with the square of the number of line breaks, and an RFC 2047 encoded word may decode to any number of them. A received message whose Subject or other header field holds such a value keeps a worker thread busy for minutes or longer each time the value is read: when the recipient's IMAP client searches, sorts or thre

Red Hat

gimp: GIMP: Remote code execution via heap-based buffer overflow in ICNS file parsing

vendor_redhat·2026-02-20·CVSS 7.8

CVE-2026-2047 [HIGH] CWE-131 gimp: GIMP: Remote code execution via heap-based buffer overflow in ICNS file parsing gimp: GIMP: Remote code execution via heap-based buffer overflow in ICNS file parsing GIMP ICNS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of ICNS files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28530. A flaw was found in GIMP. This heap-based buffer overflow vulnerability in the

Debian

CVE-2026-2047: gimp - GIMP ICNS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerab...

vendor_debian·2026·CVSS 7.8

CVE-2026-2047 [HIGH] CVE-2026-2047: gimp - GIMP ICNS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerab... GIMP ICNS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of ICNS files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28530. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 3.2.0~RC3-1) sid: resolved (fixed in 3.2.0~RC3-1) trixie: resolved (fixed in 3.0.4-3+deb13

GHSA

Mail: Email address spoofing via malformed RFC 2047 encoded-words

ghsa·2026-09-02

CVE-2026-63435 [MEDIUM] CWE-436 Mail: Email address spoofing via malformed RFC 2047 encoded-words Mail: Email address spoofing via malformed RFC 2047 encoded-words ## Summary Mail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address. ## Details Both decoders used a single String#match against a pattern such as /\=\?(.+)?\?[Qq]\?(.*)\?\=/m. Two problems: 1. Single match, dropped remainder. Only the first =?charset?Q?...?= (or ?B?) word was decoded. Any additional encoded-words or surrounding text were not h

GHSA

AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints

ghsa·2026-03-26

CVE-2026-33766 [MEDIUM] CWE-918 AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints ## Summary `isSSRFSafeURL()` validates URLs against private/reserved IP ranges before fetching, but `url_get_contents()` follows HTTP redirects without re-validating the redirect target. An attacker can bypass SSRF protection by redirecting from a public URL to an internal target. ## Root Cause **Check-time:** `isSSRFSafeURL()` at `objects/functions.php:4066` resolves the hostname and validates the IP. **Use-time:** `url_get_contents()` at `objects/functions.php:1990` calls `file_get_contents()` with PHP's default `follow_location=1` — redirects are followed without re-validation. The wget fallback at line 2047 also follows redirects by default. **Affected endpoint:** `objects/aVideoEncoderReceiveImage.js

GHSA

GHSA-xhcq-9mcp-rrvr: GIMP ICNS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

ghsa_unreviewed·2026-02-21

CVE-2026-2047 [HIGH] CWE-122 GHSA-xhcq-9mcp-rrvr: GIMP ICNS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability GIMP ICNS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of ICNS files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28530.

OSV

CVE-2026-2047: GIMP ICNS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

osv·2026-02-20·CVSS 7.8

CVE-2026-2047 [HIGH] CVE-2026-2047: GIMP ICNS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability GIMP ICNS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of ICNS files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28530.

CVE-2026-2047: GIMP ICNS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on…

Affected

CVSS provenance