CVE-2026-66757: GIMP file-sgi Plugin DOS Vulnerability

CVE-2026-66757 Overview

CVE-2026-66757 is an integer overflow vulnerability [CWE-190] in the file-sgi plugin distributed with GIMP. The flaw occurs when the plugin parses RLE-compressed SGI images and allocates memory for a row table. The plugin reads the ysize and zsize header fields as 16-bit unsigned integers and multiplies them before passing the result to calloc. A crafted SGI file that sets both dimensions to 65535 overflows the 32-bit int boundary during multiplication. The resulting undefined behavior aborts the plugin and causes a denial of service in the host GIMP process.

Critical Impact
A user who opens a malicious SGI image in GIMP triggers an integer overflow that aborts the file-sgi plugin, producing a local denial of service against the running GIMP instance.

Affected Products

GIMP (GNU Image Manipulation Program) — file-sgi plugin
Linux distributions shipping GIMP with the vulnerable plugin (see Red Hat advisory)
Any application embedding the affected GIMP SGI import code path

Discovery Timeline

2026-07-27 - CVE-2026-66757 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-66757

Vulnerability Analysis

The file-sgi plugin loads Silicon Graphics Image (SGI) files inside GIMP. When the plugin encounters an RLE-compressed SGI image, it allocates a row table sized according to the image's height (ysize) and channel count (zsize). Both values are parsed from the file header as 16-bit unsigned integers, giving each a maximum value of 65535. The plugin then multiplies ysize * zsize and passes the product to calloc to reserve the row table.

The multiplication is performed in a signed 32-bit int. Two maximum-value operands produce 65535 * 65535 = 4,294,836,225, which exceeds INT_MAX (2,147,483,647). The overflow triggers undefined behavior under the C standard. In practice, the plugin aborts, terminating image processing. The result is a denial of service constrained to the local GIMP process and any workflow depending on it.

Root Cause

The root cause is an unchecked arithmetic operation on attacker-controlled header fields. The plugin trusts ysize and zsize from the SGI header, performs the size calculation in a signed integer type without bounds validation, and does not use overflow-safe helpers before allocation. This maps directly to CWE-190: Integer Overflow or Wraparound.

Attack Vector

Exploitation requires local user interaction. An attacker delivers a crafted SGI file to the target through email, a shared drive, a download, or any other file transport. When the user opens the file in GIMP, the file-sgi plugin parses the malformed header, triggers the overflow, and aborts. No elevated privileges are required, and no network access to the target is needed. The impact is limited to availability of the GIMP process; confidentiality and integrity are not affected.

No public exploit code is currently available. Refer to the Red Hat CVE-2026-66757 Advisory and GNOME GIMP Work Item #16494 for upstream technical details.

Detection Methods for CVE-2026-66757

Indicators of Compromise

Unexpected termination or abort of the GIMP process shortly after opening an SGI file
SGI files with header fields ysize and zsize set to values near 65535 and the RLE-compressed storage flag enabled
Core dumps or crash reports referencing the file-sgi plugin binary

Detection Strategies

Inspect SGI file headers at ingress. Flag files where ysize * zsize exceeds a reasonable bound for legitimate imagery.
Correlate GIMP process crashes with recent file-open events on workstations where image editing occurs.
Hunt for SGI files delivered from untrusted sources (email attachments, external shares) on user endpoints.

Monitoring Recommendations

Monitor endpoint telemetry for abnormal exits of gimp and its plugin child processes.
Track file-write events that place SGI (.sgi, .rgb, .rgba, .bw) files in user directories from browser or mail-client processes.
Alert on repeated GIMP crashes across multiple hosts, which may indicate a targeted campaign using crafted SGI files.

How to Mitigate CVE-2026-66757

Immediate Actions Required

Apply the GIMP update from your distribution once the fix from GNOME GIMP Work Item #16494 is released.
Restrict opening SGI files from untrusted sources until the patched version is deployed.
Track vendor advisories such as the Red Hat CVE-2026-66757 Advisory for package availability.

Patch Information

Upstream tracking is handled through GNOME GIMP Work Item #16494 and downstream through the Red Hat Bug Report #2507465. Update GIMP to the fixed version supplied by your Linux distribution or the GIMP project when available. The fix is expected to validate ysize and zsize and to perform the row-table size calculation using an overflow-safe path before calling calloc.

Workarounds

Do not open SGI files (.sgi, .rgb, .rgba, .bw) from untrusted or unverified sources.
Remove or disable the file-sgi plugin from the GIMP plug-ins directory if SGI support is not required in your environment.
Preview unknown SGI files in a sandboxed environment or converter that does not use the vulnerable code path before opening them in GIMP.

bash

# Example: disable the file-sgi plugin on Linux by removing execute permission
# Adjust the path to match your distribution's GIMP plug-ins directory
sudo chmod a-x /usr/lib/gimp/2.10/plug-ins/file-sgi/file-sgi