CVE-2026-2272
published 2026-03-26CVE-2026-2272: A flaw was found in GIMP. An integer overflow vulnerability exists when processing ICO image files, specifically in the `ico_read_info` and `ico_read_icon`…
PriorityP337medium6.5CVSS 3.1
AVNACLPRNUIRSUCNINAH
EPSS
0.87%
58.5th percentile
A flaw was found in GIMP. An integer overflow vulnerability exists when processing ICO image files, specifically in the `ico_read_info` and `ico_read_icon` functions. This issue arises because a size calculation for image buffers can wrap around due to a 32-bit integer evaluation, allowing oversized image headers to bypass security checks. A remote attacker could exploit this by providing a specially crafted ICO file, leading to a buffer overflow and memory corruption, which may result in an application level denial of service.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | gimp | < gimp 2.10.34-1+deb12u8 (bookworm) | gimp 2.10.34-1+deb12u8 (bookworm) |
| gimp | gimp | — | — |
| gimp | gimp | >= 0 < 2.10.22-4+deb11u6 | 2.10.22-4+deb11u6 |
| gimp | gimp | >= 0 < 2.10.34-1+deb12u8 | 2.10.34-1+deb12u8 |
| gimp | gimp | >= 0 < 3.0.4-3+deb13u6 | 3.0.4-3+deb13u6 |
| gimp | gimp | >= 0 < 3.2.0~RC2-3.2 | 3.2.0~RC2-3.2 |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
osv6.5MEDIUM
vendor_redhat5.5LOW
vendor_debian4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2026-2272: A flaw was found in GIMP
osv·2026-03-26·CVSS 6.5
CVE-2026-2272 [MEDIUM] CVE-2026-2272: A flaw was found in GIMP
A flaw was found in GIMP. An integer overflow vulnerability exists when processing ICO image files, specifically in the `ico_read_info` and `ico_read_icon` functions. This issue arises because a size calculation for image buffers can wrap around due to a 32-bit integer evaluation, allowing oversized image headers to bypass security checks. A remote attacker could exploit this by providing a specially crafted ICO file, leading to a buffer overflow and memory corruption, which may result in an application level denial of service.
GHSA
GHSA-8g7q-m2xj-67ch: A flaw was found in GIMP
ghsa_unreviewed·2026-03-26
CVE-2026-2272 [MEDIUM] CWE-190 GHSA-8g7q-m2xj-67ch: A flaw was found in GIMP
A flaw was found in GIMP. An integer overflow vulnerability exists when processing ICO image files, specifically in the `ico_read_info` and `ico_read_icon` functions. This issue arises because a size calculation for image buffers can wrap around due to a 32-bit integer evaluation, allowing oversized image headers to bypass security checks. A remote attacker could exploit this by providing a specially crafted ICO file, leading to a buffer overflow and memory corruption, which may result in an application level denial of service.
Red Hat
kernel: net: appletalk: fix NULL pointer dereference in aarp_send_ddp()
vendor_redhat·2026-09-24·CVSS 5.5
CVE-2026-93286 [LOW] CWE-476 kernel: net: appletalk: fix NULL pointer dereference in aarp_send_ddp()
kernel: net: appletalk: fix NULL pointer dereference in aarp_send_ddp()
In the Linux kernel, the following vulnerability has been resolved:
net: appletalk: fix NULL pointer dereference in aarp_send_ddp()
aarp_send_ddp() calls atalk_find_dev_addr(dev) in the LocalTalk fast
path without checking for NULL. When the device has no AppleTalk
interface configured (dev->atalk_ptr == NULL), this leads to a NULL
pointer dereference at the at->s_net access.
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
RIP: 0010:aarp_send_ddp (net/appletalk/aarp.c:552 (discriminator 2))
Call Trace:
atalk_sendmsg (net/appletalk/ddp.c:1715)
__sys_sendto (net/socket.c:2265 (discriminator 1))
__x64_sys_sendto (net/socket.c:2272)
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
entry_SYSCALL_64_af
Red Hat
gimp: GIMP: Memory corruption due to integer overflow in ICO file handling
vendor_redhat·2026-02-10·CVSS 4.3
CVE-2026-2272 [MEDIUM] CWE-190 gimp: GIMP: Memory corruption due to integer overflow in ICO file handling
gimp: GIMP: Memory corruption due to integer overflow in ICO file handling
A flaw was found in GIMP. An integer overflow vulnerability exists when processing ICO image files, specifically in the `ico_read_info` and `ico_read_icon` functions. This issue arises because a size calculation for image buffers can wrap around due to a 32-bit integer evaluation, allowing oversized image headers to bypass security checks. A remote attacker could exploit this by providing a specially crafted ICO file, leading to a buffer overflow and memory corruption, which may result in an application level denial of service.
A flaw was found in GIMP. An integer overflow vulnerability exists when processing ICO image files, specifically in the `ico_read_info` and `ico_read_icon` functions. This issue arises beca
Debian
CVE-2026-2272: gimp - A flaw was found in GIMP. An integer overflow vulnerability exists when processi...
vendor_debian·2026·CVSS 4.3
CVE-2026-2272 [MEDIUM] CVE-2026-2272: gimp - A flaw was found in GIMP. An integer overflow vulnerability exists when processi...
A flaw was found in GIMP. An integer overflow vulnerability exists when processing ICO image files, specifically in the `ico_read_info` and `ico_read_icon` functions. This issue arises because a size calculation for image buffers can wrap around due to a 32-bit integer evaluation, allowing oversized image headers to bypass security checks. A remote attacker could exploit this by providing a specially crafted ICO file, leading to a buffer overflow and memory corruption, which may result in an application level denial of service.
Scope: local
bookworm: resolved (fixed in 2.10.34-1+deb12u8)
bullseye: resolved (fixed in 2.10.22-4+deb11u6)
forky: resolved (fixed in 3.2.0~RC2-3.2)
sid: resolved (fixed in 3.2.0~RC2-3.2)
trixie: resolved (fixed in 3.0.4-3+deb13u6)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-93286 kernel: net: appletalk: fix NULL pointer dereference in aarp_send_ddp()
bugzilla·2026-09-24
CVE-2026-93286 [LOW] CVE-2026-93286 kernel: net: appletalk: fix NULL pointer dereference in aarp_send_ddp()
CVE-2026-93286 kernel: net: appletalk: fix NULL pointer dereference in aarp_send_ddp()
In the Linux kernel, the following vulnerability has been resolved:
net: appletalk: fix NULL pointer dereference in aarp_send_ddp()
aarp_send_ddp() calls atalk_find_dev_addr(dev) in the LocalTalk fast
path without checking for NULL. When the device has no AppleTalk
interface configured (dev->atalk_ptr == NULL), this leads to a NULL
pointer dereference at the at->s_net access.
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
RIP: 0010:aarp_send_ddp (net/appletalk/aarp.c:552 (discriminator 2))
Call Trace:
atalk_sendmsg (net/appletalk/ddp.c:1715)
__sys_sendto (net/socket.c:2265 (discriminator 1))
__x64_sys_sendto (net/socket.c:2272)
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
e
Bugzilla
CVE-2026-2272 gimp: GIMP: Memory corruption due to integer overflow in ICO file handling
bugzilla·2026-02-10·CVSS 6.5
CVE-2026-2272 [MEDIUM] CVE-2026-2272 gimp: GIMP: Memory corruption due to integer overflow in ICO file handling
CVE-2026-2272 gimp: GIMP: Memory corruption due to integer overflow in ICO file handling
Summary
ico_read_info sizes the image and buf from ICO directory entry dimensions, but ico_read_icon trusts BITMAPINFOHEADER width/height for decoding, creating a mismatch when header dimensions are larger. The size guard data.width * data.height * 2 > maxsize is evaluated in 32‑bit guint32 and can wrap, letting oversized headers pass like this:
if (data.width * data.height * 2 > maxsize) { /* ... */ }
Decode loops then use large w/h and write past the buffer sized from the entry, and ico_alloc_map uses gint length math that can overflow for xor_map/and_map when dimensions are huge.
Proof-of-concept
import struct
hdr = struct.pack("<HHH", 0, 1, 1)
# IcoFileEntry: width=1, height=1, colors=0, re
Wiz
CVE-2026-2272 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 4.3
CVE-2026-2272 [MEDIUM] CVE-2026-2272 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-2272 :
NixOS vulnerability analysis and mitigation
ico_read_info
ico_read_icon
Source : NVD
## 6.5
Score
Published March 26, 2026
Severity MEDIUM
CNA Score 4.3
Affected Technologies
NixOS
Homebrew
Has Public Exploit Yes
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 24.2
Exploitation Probability (EPSS) 0.1
Affected packages and libraries
gimp-devel-tools
gimp:2.8::gimp-libs
Sources
Debian 11, 12, 13, 14 Severity MEDIUM Has Fix Added at: Feb 11, 2026
Echo Severity MEDIUM Has Fix Added at: Feb 12, 2026
Homebrew Severity MEDIUM No Fix Added at: Apr 06, 2026
Nix Severity MEDIUM No Fix Added at: Apr 06, 2026
Red Hat 6, 7, 8, 9 Severity MEDIUM No Fix Added at: Feb 11, 2026
Windows Severi
2026-03-26
Published