CVE-2026-2272
published 2026-03-26CVE-2026-2272: A flaw was found in GIMP. An integer overflow vulnerability exists when processing ICO image files, specifically in the `ico_read_info` and `ico_read_icon`…
PriorityP337medium6.5CVSS 3.1
AVNACLPRNUIRSUCNINAH
EPSS
0.84%
53.7th percentile
A flaw was found in GIMP. An integer overflow vulnerability exists when processing ICO image files, specifically in the `ico_read_info` and `ico_read_icon` functions. This issue arises because a size calculation for image buffers can wrap around due to a 32-bit integer evaluation, allowing oversized image headers to bypass security checks. A remote attacker could exploit this by providing a specially crafted ICO file, leading to a buffer overflow and memory corruption, which may result in an application level denial of service.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | gimp | < gimp 2.10.34-1+deb12u8 (bookworm) | gimp 2.10.34-1+deb12u8 (bookworm) |
| gimp | gimp | — | — |
| gimp | gimp | >= 0 < 2.10.22-4+deb11u6 | 2.10.22-4+deb11u6 |
| gimp | gimp | >= 0 < 2.10.34-1+deb12u8 | 2.10.34-1+deb12u8 |
| gimp | gimp | >= 0 < 3.0.4-3+deb13u6 | 3.0.4-3+deb13u6 |
| gimp | gimp | >= 0 < 3.2.0~RC2-3.2 | 3.2.0~RC2-3.2 |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
osv6.5MEDIUM
vendor_debian4.3MEDIUM
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2026-2272: A flaw was found in GIMP
osv·2026-03-26·CVSS 6.5
CVE-2026-2272 [MEDIUM] CVE-2026-2272: A flaw was found in GIMP
A flaw was found in GIMP. An integer overflow vulnerability exists when processing ICO image files, specifically in the `ico_read_info` and `ico_read_icon` functions. This issue arises because a size calculation for image buffers can wrap around due to a 32-bit integer evaluation, allowing oversized image headers to bypass security checks. A remote attacker could exploit this by providing a specially crafted ICO file, leading to a buffer overflow and memory corruption, which may result in an application level denial of service.
GHSA
GHSA-8g7q-m2xj-67ch: A flaw was found in GIMP
ghsa_unreviewed·2026-03-26
CVE-2026-2272 [MEDIUM] CWE-190 GHSA-8g7q-m2xj-67ch: A flaw was found in GIMP
A flaw was found in GIMP. An integer overflow vulnerability exists when processing ICO image files, specifically in the `ico_read_info` and `ico_read_icon` functions. This issue arises because a size calculation for image buffers can wrap around due to a 32-bit integer evaluation, allowing oversized image headers to bypass security checks. A remote attacker could exploit this by providing a specially crafted ICO file, leading to a buffer overflow and memory corruption, which may result in an application level denial of service.
Red Hat
gimp: GIMP: Memory corruption due to integer overflow in ICO file handling
vendor_redhat·2026-02-10·CVSS 4.3
CVE-2026-2272 [MEDIUM] CWE-190 gimp: GIMP: Memory corruption due to integer overflow in ICO file handling
gimp: GIMP: Memory corruption due to integer overflow in ICO file handling
A flaw was found in GIMP. An integer overflow vulnerability exists when processing ICO image files, specifically in the `ico_read_info` and `ico_read_icon` functions. This issue arises because a size calculation for image buffers can wrap around due to a 32-bit integer evaluation, allowing oversized image headers to bypass security checks. A remote attacker could exploit this by providing a specially crafted ICO file, leading to a buffer overflow and memory corruption, which may result in an application level denial of service.
A flaw was found in GIMP. An integer overflow vulnerability exists when processing ICO image files, specifically in the `ico_read_info` and `ico_read_icon` functions. This issue arises beca
Debian
CVE-2026-2272: gimp - A flaw was found in GIMP. An integer overflow vulnerability exists when processi...
vendor_debian·2026·CVSS 4.3
CVE-2026-2272 [MEDIUM] CVE-2026-2272: gimp - A flaw was found in GIMP. An integer overflow vulnerability exists when processi...
A flaw was found in GIMP. An integer overflow vulnerability exists when processing ICO image files, specifically in the `ico_read_info` and `ico_read_icon` functions. This issue arises because a size calculation for image buffers can wrap around due to a 32-bit integer evaluation, allowing oversized image headers to bypass security checks. A remote attacker could exploit this by providing a specially crafted ICO file, leading to a buffer overflow and memory corruption, which may result in an application level denial of service.
Scope: local
bookworm: resolved (fixed in 2.10.34-1+deb12u8)
bullseye: resolved (fixed in 2.10.22-4+deb11u6)
forky: resolved (fixed in 3.2.0~RC2-3.2)
sid: resolved (fixed in 3.2.0~RC2-3.2)
trixie: resolved (fixed in 3.0.4-3+deb13u6)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-2272 gimp: GIMP: Memory corruption due to integer overflow in ICO file handling
bugzilla·2026-02-10·CVSS 6.5
CVE-2026-2272 [MEDIUM] CVE-2026-2272 gimp: GIMP: Memory corruption due to integer overflow in ICO file handling
CVE-2026-2272 gimp: GIMP: Memory corruption due to integer overflow in ICO file handling
Summary
ico_read_info sizes the image and buf from ICO directory entry dimensions, but ico_read_icon trusts BITMAPINFOHEADER width/height for decoding, creating a mismatch when header dimensions are larger. The size guard data.width * data.height * 2 > maxsize is evaluated in 32‑bit guint32 and can wrap, letting oversized headers pass like this:
if (data.width * data.height * 2 > maxsize) { /* ... */ }
Decode loops then use large w/h and write past the buffer sized from the entry, and ico_alloc_map uses gint length math that can overflow for xor_map/and_map when dimensions are huge.
Proof-of-concept
import struct
hdr = struct.pack("<HHH", 0, 1, 1)
# IcoFileEntry: width=1, height=1, colors=0, re
Wiz
CVE-2026-2272 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 4.3
CVE-2026-2272 [MEDIUM] CVE-2026-2272 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-2272 :
NixOS vulnerability analysis and mitigation
ico_read_info
ico_read_icon
Source : NVD
## 6.5
Score
Published March 26, 2026
Severity MEDIUM
CNA Score 4.3
Affected Technologies
NixOS
Homebrew
Has Public Exploit Yes
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 24.2
Exploitation Probability (EPSS) 0.1
Affected packages and libraries
gimp-devel-tools
gimp:2.8::gimp-libs
Sources
Debian 11, 12, 13, 14 Severity MEDIUM Has Fix Added at: Feb 11, 2026
Echo Severity MEDIUM Has Fix Added at: Feb 12, 2026
Homebrew Severity MEDIUM No Fix Added at: Apr 06, 2026
Nix Severity MEDIUM No Fix Added at: Apr 06, 2026
Red Hat 6, 7, 8, 9 Severity MEDIUM No Fix Added at: Feb 11, 2026
Windows Severi
2026-03-26
Published