CVE-2026-42169: GIMP Buffer Overflow Vulnerability

CVE-2026-42169 Overview

CVE-2026-42169 is a heap-based buffer overflow in the GNU Image Manipulation Program (GIMP) affecting two image loaders. The Animated PNG (APNG) loader writes pixel data past a heap allocation when the frame control (fcTL) chunk width exceeds the image header (IHDR) width. A related heap overflow exists in the DirectDraw Surface (DDS) plug-in caused by a bits-per-pixel (BPP) mismatch in the load_layer() function. Opening a crafted image file can trigger memory corruption and potentially arbitrary code execution in the user context. The flaw is tracked under CWE-131: Incorrect Calculation of Buffer Size.

Critical Impact
A single malicious APNG or DDS file opened in GIMP can corrupt heap memory and lead to code execution with the privileges of the user running GIMP.

Affected Products

GNU Image Manipulation Program (GIMP) APNG file loader
GNU Image Manipulation Program (GIMP) DDS plug-in
Red Hat Enterprise Linux distributions shipping affected GIMP packages

Discovery Timeline

2026-08-04 - CVE-2026-42169 published to the National Vulnerability Database
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-42169

Vulnerability Analysis

CVE-2026-42169 covers two distinct heap-based buffer overflows reachable through GIMP's image import path. Both defects arise from trusting attacker-controlled dimensions declared inside image chunk metadata without validating them against the allocation actually made for pixel data.

In the APNG loader, GIMP allocates a pixel buffer sized according to the IHDR chunk. When a subsequent fcTL frame control chunk declares a width greater than the IHDR width, the loader writes decoded pixel data based on the larger fcTL value. This overruns the smaller heap allocation with attacker-controlled bytes.

In the DDS plug-in, the load_layer() function calculates pixel storage using one bits-per-pixel value while the copy loop uses another. The BPP mismatch causes writes to exceed the layer buffer boundary.

Root Cause

The root cause is missing cross-field validation between size-defining metadata and the allocation used to hold decoded data. The APNG parser treats fcTL dimensions as authoritative for the write loop after sizing the buffer from IHDR. The DDS parser mixes two BPP interpretations across allocation and copy, yielding an incorrect buffer size calculation consistent with [CWE-131].

Attack Vector

Exploitation requires a local user to open a crafted APNG or DDS file in GIMP. The CVSS metrics indicate a local attack vector with user interaction required and low privileges. Delivery is typically social-engineered: an attacker sends the file through email, chat, a shared drive, or a web download and induces the victim to open it in GIMP. Successful exploitation corrupts heap metadata adjacent to the overflowing allocation, and can be shaped into arbitrary code execution in the GIMP process context.

No public exploit is currently listed, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities catalog. Technical details are documented in the Red Hat CVE record and the corresponding Red Hat Bugzilla entry.

Detection Methods for CVE-2026-42169

Indicators of Compromise

APNG files where the fcTL chunk declares a width greater than the IHDR chunk width
DDS files whose header BPP field disagrees with the pixel format implied by the DDS pixel format block
Unexpected crashes, SIGSEGV, or glibc heap corruption messages produced by the gimp process after opening image files
New child processes or shell invocations spawned by gimp shortly after an image import

Detection Strategies

Deploy endpoint telemetry that records process ancestry for gimp and alerts when it spawns interpreters or shells such as bash, python, or sh
Scan image repositories and mail gateways for APNG files whose fcTL width exceeds the IHDR width using a lightweight PNG chunk parser
Enable AddressSanitizer or glibc MALLOC_CHECK_ in test environments to surface the heap overflow deterministically during triage

Monitoring Recommendations

Forward GIMP crash reports and core dumps from user workstations to a central log store for review
Alert on execution of gimp from directories associated with email attachments, browser downloads, or removable media
Track package inventory to confirm every workstation has moved to the patched GIMP build referenced in RHSA-2026:50817

How to Mitigate CVE-2026-42169

Immediate Actions Required

Apply the vendor-supplied GIMP update as soon as it is available for your distribution
Instruct users not to open APNG or DDS files received from untrusted sources until patching completes
Inventory systems with GIMP installed, including developer and design workstations, and prioritize them for update
Restrict GIMP execution on high-value hosts where image editing is not a business requirement

Patch Information

Red Hat has issued fixes through RHSA-2026:50817. Administrators should update GIMP to the version specified in that advisory and confirm the APNG loader and DDS plug-in are replaced. Upstream GIMP and other Linux distributions are expected to ship corresponding fixes; consult your distribution's security tracker before deploying.

Workarounds

Remove or disable the DDS plug-in and any APNG import support if patching is not immediately feasible
Open untrusted image files inside a sandbox such as Flatpak with restricted filesystem access, or inside a disposable virtual machine
Configure mail and web gateways to strip or quarantine .dds and animated .png attachments from external senders

bash

# Example: verify installed GIMP version and remove the DDS plug-in as a temporary workaround
rpm -q gimp
find /usr/lib64/gimp -name 'dds*' -print
sudo mv /usr/lib64/gimp/2.10/plug-ins/file-dds /root/file-dds.disabled