CVE-2026-2047
published 2026-02-20CVE-2026-2047: GIMP ICNS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on…
PriorityP346high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
0.62%
47.4th percentile
GIMP ICNS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of ICNS files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28530.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | gimp | < gimp 3.2.0~RC3-1 (forky) | gimp 3.2.0~RC3-1 (forky) |
| gimp | gimp | — | — |
| gimp | gimp | >= 0 < 3.0.4-3+deb13u7 | 3.0.4-3+deb13u7 |
| gimp | gimp | >= 0 < 3.2.0~RC3-1 | 3.2.0~RC3-1 |
| wwbn | avideo | 0 – 26.0 | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8LOW
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
gimp: GIMP: Remote code execution via heap-based buffer overflow in ICNS file parsing
vendor_redhat·2026-02-20·CVSS 7.8
CVE-2026-2047 [HIGH] CWE-131 gimp: GIMP: Remote code execution via heap-based buffer overflow in ICNS file parsing
gimp: GIMP: Remote code execution via heap-based buffer overflow in ICNS file parsing
GIMP ICNS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of ICNS files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28530.
A flaw was found in GIMP. This heap-based buffer overflow vulnerability in the
Debian
CVE-2026-2047: gimp - GIMP ICNS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerab...
vendor_debian·2026·CVSS 7.8
CVE-2026-2047 [HIGH] CVE-2026-2047: gimp - GIMP ICNS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerab...
GIMP ICNS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of ICNS files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28530.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved (fixed in 3.2.0~RC3-1)
sid: resolved (fixed in 3.2.0~RC3-1)
trixie: resolved (fixed in 3.0.4-3+deb13
GHSA
Mail: Email address spoofing via malformed RFC 2047 encoded-words
ghsa·2026-09-02
CVE-2026-63435 [MEDIUM] CWE-436 Mail: Email address spoofing via malformed RFC 2047 encoded-words
Mail: Email address spoofing via malformed RFC 2047 encoded-words
## Summary
Mail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address.
## Details
Both decoders used a single String#match against a pattern such as /\=\?(.+)?\?[Qq]\?(.*)\?\=/m. Two problems:
1. Single match, dropped remainder. Only the first =?charset?Q?...?= (or ?B?) word was decoded. Any additional encoded-words or surrounding text were not h
GHSA
AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints
ghsa·2026-03-26
CVE-2026-33766 [MEDIUM] CWE-918 AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints
AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints
## Summary
`isSSRFSafeURL()` validates URLs against private/reserved IP ranges before fetching, but `url_get_contents()` follows HTTP redirects without re-validating the redirect target. An attacker can bypass SSRF protection by redirecting from a public URL to an internal target.
## Root Cause
**Check-time:** `isSSRFSafeURL()` at `objects/functions.php:4066` resolves the hostname and validates the IP.
**Use-time:** `url_get_contents()` at `objects/functions.php:1990` calls `file_get_contents()` with PHP's default `follow_location=1` — redirects are followed without re-validation. The wget fallback at line 2047 also follows redirects by default.
**Affected endpoint:** `objects/aVideoEncoderReceiveImage.js
GHSA
GHSA-xhcq-9mcp-rrvr: GIMP ICNS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
ghsa_unreviewed·2026-02-21
CVE-2026-2047 [HIGH] CWE-122 GHSA-xhcq-9mcp-rrvr: GIMP ICNS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
GIMP ICNS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of ICNS files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28530.
OSV
CVE-2026-2047: GIMP ICNS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
osv·2026-02-20·CVSS 7.8
CVE-2026-2047 [HIGH] CVE-2026-2047: GIMP ICNS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
GIMP ICNS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of ICNS files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28530.
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-2047 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.8
CVE-2026-2047 [HIGH] CVE-2026-2047 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-2047 :
NixOS vulnerability analysis and mitigation
GIMP ICNS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of ICNS files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28530.
Source : NVD
## 7.8
Score
Published February 20, 2026
Severity HIGH
CNA Score 7.8
Affected T
Bugzilla
CVE-2026-2047 gimp: GIMP: Remote code execution via heap-based buffer overflow in ICNS file parsing
bugzilla·2026-02-20·CVSS 7.8
CVE-2026-2047 [HIGH] CVE-2026-2047 gimp: GIMP: Remote code execution via heap-based buffer overflow in ICNS file parsing
CVE-2026-2047 gimp: GIMP: Remote code execution via heap-based buffer overflow in ICNS file parsing
GIMP ICNS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of ICNS files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28530.
Discussion:
This issue has been addressed in the following prod
https://gitlab.gnome.org/GNOME/gimp/-/merge_requests/2600/diffs?commit_id=dd2faac351f1ff2588529fedc606e6a5f815577chttps://www.zerodayinitiative.com/advisories/ZDI-26-120/https://access.redhat.com/errata/RHSA-2026:4173https://access.redhat.com/security/cve/CVE-2026-2047https://bugzilla.redhat.com/show_bug.cgi?id=2441517https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2047.json
2026-02-20
Published