CVE-2026-40917
published 2026-04-15CVE-2026-40917: A flaw was found in GIMP. This vulnerability, a heap buffer over-read in the `icns_slurp()` function, occurs when processing specially crafted ICNS image…
PriorityP430high7.1CVSS 3.1
AVLACLPRNUIRSUCHINAH
EPSS
0.17%
6.2th percentile
A flaw was found in GIMP. This vulnerability, a heap buffer over-read in the `icns_slurp()` function, occurs when processing specially crafted ICNS image files. An attacker could provide a malicious ICNS file, potentially leading to application crashes or information disclosure on systems that process such files.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.17.1HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
vendor_redhat5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
GIMP ICNS Image icns_slurp out-of-bounds
vuldb·2026-04-16·CVSS 5.0
CVE-2026-40917 [MEDIUM] GIMP ICNS Image icns_slurp out-of-bounds
A vulnerability categorized as problematic has been discovered in GIMP. Affected by this issue is the function icns_slurp of the component ICNS Image Handler. Executing a manipulation can lead to out-of-bounds read.
This vulnerability is registered as CVE-2026-40917. It is possible to launch the attack remotely. No exploit is available.
GHSA
GHSA-856r-6q67-9x29: A flaw was found in GIMP
ghsa_unreviewed·2026-04-15
CVE-2026-40917 [MEDIUM] CWE-125 GHSA-856r-6q67-9x29: A flaw was found in GIMP
A flaw was found in GIMP. This vulnerability, a heap buffer over-read in the `icns_slurp()` function, occurs when processing specially crafted ICNS image files. An attacker could provide a malicious ICNS file, potentially leading to application crashes or information disclosure on systems that process such files.
Red Hat
gimp: GIMP: Application crashes or information disclosure via crafted ICNS image files
vendor_redhat·2026-04-15·CVSS 5.0
CVE-2026-40917 [MEDIUM] CWE-125 gimp: GIMP: Application crashes or information disclosure via crafted ICNS image files
gimp: GIMP: Application crashes or information disclosure via crafted ICNS image files
A flaw was found in GIMP. This vulnerability, a heap buffer over-read in the `icns_slurp()` function, occurs when processing specially crafted ICNS image files. An attacker could provide a malicious ICNS file, potentially leading to application crashes or information disclosure on systems that process such files.
Statement: This Moderate impact flaw in GIMP is due to a heap buffer over-read when processing specially crafted ICNS image files. Exploitation requires a user to open a malicious ICNS file, which could lead to application crashes or information disclosure.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security
No detection rules found.
No public exploits indexed.
2026-04-15
Published