CVE-2026-66758
published 2026-07-27CVE-2026-66758: A flaw was found in the file-fits plugin in GIMP. When processing a FITS image file, the plugin calculates memory allocation sizes using signed 32-bit integers…
PriorityP343high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
0.30%
21.1th percentile
A flaw was found in the file-fits plugin in GIMP. When processing a FITS image file, the plugin calculates memory allocation sizes using signed 32-bit integers for width and height. If a crafted file sets both values to large values, their product exceeds 2^31 and overflows, resulting in an undersized heap-based buffer allocation. This integer overflow issue results in a heap-based buffer overflow when cfitsio subsequently writes a full row of pixels in the buffer, causing memory corruption, potentially leading to arbitrary code execution or a denial of service.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gimp | gimp | — | — |
| gimp | gimp | — | — |
| gimp | gimp | — | — |
| gimp_2.8 | gimp | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
gimp: integer overflow in file-fits plugin causes a heap-based buffer overflow on crafted FITS images
vendor_redhat·2026-07-07·CVSS 7.8
CVE-2026-66758 [HIGH] CWE-190 gimp: integer overflow in file-fits plugin causes a heap-based buffer overflow on crafted FITS images
gimp: integer overflow in file-fits plugin causes a heap-based buffer overflow on crafted FITS images
A flaw was found in the file-fits plugin in GIMP. When processing a FITS image file, the plugin calculates memory allocation sizes using signed 32-bit integers for width and height. If a crafted file sets both values to large values, their product exceeds 2^31 and overflows, resulting in an undersized heap-based buffer allocation. This integer overflow issue results in a heap-based buffer overflow when cfitsio subsequently writes a full row of pixels in the buffer, causing memory corruption, potentially leading to arbitrary code execution or a denial of service.
Statement: To exploit this vulnerability, an attacker needs to convince a user to process a specially crafted FITS image with G
GHSA
A flaw was found in the file-fits plugin in GIMP.
ghsa_unreviewed·2026-07-27
CVE-2026-66758 [HIGH] CWE-190 A flaw was found in the file-fits plugin in GIMP.
A flaw was found in the file-fits plugin in GIMP. When processing a FITS image file, the plugin calculates memory allocation sizes using signed 32-bit integers for width and height. If a crafted file sets both values to large values, their product exceeds 2^31 and overflows, resulting in an undersized heap-based buffer allocation. This integer overflow issue results in a heap-based buffer overflow when cfitsio subsequently writes a full row of pixels in the buffer, causing memory corruption, potentially leading to arbitrary code execution or a denial of service.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-66758 gimp: integer overflow in file-fits plugin causes a heap-based buffer overflow on crafted FITS images
bugzilla·2026-07-27·CVSS 7.8
CVE-2026-66758 [HIGH] CVE-2026-66758 gimp: integer overflow in file-fits plugin causes a heap-based buffer overflow on crafted FITS images
CVE-2026-66758 gimp: integer overflow in file-fits plugin causes a heap-based buffer overflow on crafted FITS images
A flaw was found in the file-fits plugin in GIMP, affecting all versions. When processing a FITS image file, the plugin calculates memory allocation sizes using signed 32-bit integers for width and height. If a crafted file sets both values to large values, their product exceeds 2^31 and overflows, resulting in an undersized heap-based buffer allocation. This integer overflow issue results in a heap-based buffer overflow when cfitsio subsequently writes a full row of pixels in the buffer, causing memory corruption, potentially leading to arbitrary code execution or a denial of service.
Bugzilla
CVE-2026-66758 gimp: integer overflow in file-fits plugin causes a heap-based buffer overflow on crafted FITS images [fedora-all]
bugzilla·2026-07-27·CVSS 7.8
CVE-2026-66758 [HIGH] CVE-2026-66758 gimp: integer overflow in file-fits plugin causes a heap-based buffer overflow on crafted FITS images [fedora-all]
CVE-2026-66758 gimp: integer overflow in file-fits plugin causes a heap-based buffer overflow on crafted FITS images [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in the file-fits plugin in GIMP, affecting all versions. When processing a FITS image file, the plugin calculates memory allocation sizes using signed 32-bit integers for width and height. If a crafted file sets both values to large values, their product exceeds 2^31 and overflows, resulting in an undersized heap-based buffer allocation. This integer overflow issue results in a heap-based buffer overflow when cfitsio subseq
https://access.redhat.com/errata/RHSA-2026:50817https://access.redhat.com/errata/RHSA-2026:62507https://access.redhat.com/errata/RHSA-2026:73768https://access.redhat.com/errata/RHSA-2026:80509https://access.redhat.com/security/cve/CVE-2026-66758https://bugzilla.redhat.com/show_bug.cgi?id=2507475https://gitlab.gnome.org/GNOME/gimp/-/issues/16528
2026-07-27
Published