CVE-2026-42169
published 2026-08-04CVE-2026-42169: A heap-buffer-overflow vulnerability exists in the APNG (Animated PNG) file loader of GIMP. This flaw occurs when the `fcTL` width exceeds the `IHDR` width…
PriorityP339high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
0.13%
2.8th percentile
A heap-buffer-overflow vulnerability exists in the APNG (Animated PNG) file loader of GIMP. This flaw occurs when the `fcTL` width exceeds the `IHDR` width, leading to pixel data being written past the end of a heap allocation. Additionally, a heap-based buffer overflow exists in the DDS plug-in due to a BPP mismatch in the `load_layer()` function. Both vulnerabilities can be triggered by opening a specially crafted image file, potentially leading to code execution.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gimp | gimp | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux_eus | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vendor_redhat7.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
gimp: GIMP APNG loader heap-buffer-overflow when fcTL width exceeds IHDR width (file-png.c)
vendor_redhat·2026-08-04·CVSS 7.3
CVE-2026-42169 [MEDIUM] CWE-131 gimp: GIMP APNG loader heap-buffer-overflow when fcTL width exceeds IHDR width (file-png.c)
gimp: GIMP APNG loader heap-buffer-overflow when fcTL width exceeds IHDR width (file-png.c)
A heap-buffer-overflow vulnerability exists in the APNG (Animated PNG) file loader of GIMP. This flaw occurs when the `fcTL` width exceeds the `IHDR` width, leading to pixel data being written past the end of a heap allocation. Additionally, a heap-based buffer overflow exists in the DDS plug-in due to a BPP mismatch in the `load_layer()` function. Both vulnerabilities can be triggered by opening a specially crafted image file, potentially leading to code execution.
Statement: This vulnerability in GIMP's APNG loader and DDS plug-in could lead to a heap-buffer-overflow when processing specially crafted image files. Exploitation requires a user to open a malicious APNG or DDS image. Red Hat product
VulDB
GIMP Loader file-png.c heap-based overflow
vuldb·2026-08-04
CVE-2026-42169 [CRITICAL] GIMP Loader file-png.c heap-based overflow
A vulnerability marked as critical has been reported in GIMP. This affects an unknown part of the file file-png.c of the component Loader. The manipulation leads to heap-based buffer overflow.
This vulnerability is traded as CVE-2026-42169. It is possible to initiate the attack remotely. There is no exploit available.
GHSA
A heap-buffer-overflow vulnerability exists in the APNG (Animated PNG) file loader of GIMP.
ghsa_unreviewed·2026-08-04
CVE-2026-42169 [HIGH] CWE-131 A heap-buffer-overflow vulnerability exists in the APNG (Animated PNG) file loader of GIMP.
A heap-buffer-overflow vulnerability exists in the APNG (Animated PNG) file loader of GIMP. This flaw occurs when the `fcTL` width exceeds the `IHDR` width, leading to pixel data being written past the end of a heap allocation. Additionally, a heap-based buffer overflow exists in the DDS plug-in due to a BPP mismatch in the `load_layer()` function. Both vulnerabilities can be triggered by opening a specially crafted image file, potentially leading to code execution.
No detection rules found.
No public exploits indexed.
2026-08-04
Published