CVE-2026-78475: GIMP file-pix Plugin DOS Vulnerability

CVE-2026-78475 Overview

CVE-2026-78475 is an out-of-bounds read vulnerability in the file-pix (ESM) plugin of GIMP. The plugin allocates a Variable-Length Array (VLA) on the stack when processing a crafted PIX image file. Because the plugin lacks proper bounds checking, an attacker-controlled size drives an unbounded stack allocation followed by a 21-byte stack over-read. Exploitation causes denial of service through stack exhaustion and leaks stack memory contents into an intermediate output file. The flaw is classified under CWE-125: Out-of-bounds Read. Local user interaction is required, since a victim must open the malicious PIX file in GIMP.

Critical Impact
A crafted PIX file can crash GIMP through stack exhaustion and disclose limited stack memory contents to an intermediate file when opened by a local user.

Affected Products

GIMP file-pix (ESM) plugin
See the GNOME GIMP Work Item #16580 for tracking
See the Red Hat CVE-2026-78475 Advisory for downstream package status

Discovery Timeline

2026-08-24 - CVE-2026-78475 published to the National Vulnerability Database
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-78475

Vulnerability Analysis

The file-pix plugin ships with GIMP to load Alias/Wavefront PIX and Esm Software PIX raster images. When parsing a PIX file, the plugin reads size fields from the file header and uses them to allocate a Variable-Length Array on the stack. The allocation size is not validated against a safe upper bound. An attacker can therefore set the header fields to values that push the stack allocation beyond available stack space, terminating the process.

After the VLA is allocated, the plugin reads image data into that stack region. The read overruns the intended buffer by 21 bytes, exposing adjacent stack contents. GIMP later writes those bytes into an intermediate file used during import, which turns a memory safety bug into a limited information disclosure primitive.

Root Cause

The root cause is missing bounds validation on attacker-controlled length fields before both a stack-based VLA allocation and a subsequent buffer read. This pattern maps directly to CWE-125: Out-of-bounds Read, compounded by unbounded stack allocation behavior. The plugin trusts file-supplied dimensions rather than clamping them to a defined maximum.

Attack Vector

Exploitation requires local user interaction. An attacker delivers a crafted PIX file through email, a shared drive, a download, or an archive. When a user opens the file in GIMP, the file-pix plugin parses it and triggers the flaw. The attacker cannot execute code remotely and does not obtain privileges beyond the invoking user. The impact is limited to crashing GIMP and leaking stack bytes through the intermediate file produced during import.

No public proof-of-concept exploit is currently listed for CVE-2026-78475. See the Red Hat Bugzilla Report #2522072 for reproduction details.

Detection Methods for CVE-2026-78475

Indicators of Compromise

Unexpected GIMP crashes shortly after opening .pix or .matte files
Presence of untrusted PIX files delivered via email, downloads, or shared storage prior to a GIMP crash
Intermediate files produced by GIMP that contain non-image byte patterns consistent with process stack contents
Core dumps from the GIMP process referencing the file-pix plugin in the crashing frame

Detection Strategies

Monitor endpoint telemetry for abnormal termination of the gimp process correlated with recent PIX file access
Alert on GIMP writing intermediate files whose size or entropy differs from expected image import output
Inspect email and web download gateways for uncommon .pix attachments from untrusted senders
Correlate file open events for PIX images with subsequent process crash events on the same host

Monitoring Recommendations

Enable core dump collection on workstations running GIMP so crash frames in the file-pix plugin can be triaged
Track GIMP version inventory across endpoints and flag hosts running unpatched builds
Log parent-child process relationships around GIMP to detect any follow-on activity after a crash

How to Mitigate CVE-2026-78475

Immediate Actions Required

Apply the GIMP update that addresses CVE-2026-78475 once your distribution publishes the patched package
Restrict handling of untrusted .pix files until the fix is deployed on all workstations with GIMP installed
Communicate to design, graphics, and media teams that PIX files from external sources should not be opened until patched
Track distribution advisories through the Red Hat CVE-2026-78475 Advisory and equivalent vendor channels

Patch Information

At publication time, the upstream fix is tracked in GNOME GIMP Work Item #16580. Downstream package status for enterprise Linux distributions is tracked in the Red Hat CVE-2026-78475 Advisory and Red Hat Bugzilla Report #2522072. Apply vendor updates as they become available for your platform.

Workarounds

Do not open PIX files from untrusted or unverified sources in GIMP
Disable or remove the file-pix plugin from GIMP plugin directories if PIX support is not required
Convert suspect PIX files to a different format using an isolated, sandboxed converter before opening in GIMP
Run GIMP inside a sandbox such as Flatpak or Firejail to contain the impact of a plugin crash and reduce filesystem exposure