CVE-2026-80101: GIMP file-xwd Plugin DOS Vulnerability

CVE-2026-80101 Overview

A heap out-of-bounds read vulnerability affects the file-xwd plugin in GIMP. The plugin parses X Window Dump (XWD) image files and validates the image width and bytes-per-line parameters independently. It does not verify that the combined values remain consistent with the allocated buffer size. An attacker who convinces a user to open a crafted XWD file can trigger the flaw, resulting in an application crash or limited disclosure of adjacent heap memory into the produced image. The issue is tracked under [CWE-125: Out-of-bounds Read].

Critical Impact
Processing a malicious XWD file can crash GIMP or leak heap memory contents through the rendered image output.

Affected Products

GIMP (GNU Image Manipulation Program) file-xwd plugin
Distributions shipping the vulnerable GIMP package (see Red Hat advisory)
Applications embedding the affected GIMP XWD parser

Discovery Timeline

2026-08-25 - CVE-2026-80101 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-80101

Vulnerability Analysis

The file-xwd plugin reads XWD headers to determine image geometry. Two header fields, image width and bytes-per-line, are validated separately against acceptable ranges. The plugin does not cross-check these fields against the size of the buffer allocated to hold pixel data. When the combined product of width, bytes-per-line, and row count exceeds the allocated region, the decoder reads past the end of the heap buffer. The result is either a segmentation fault that terminates the process or leakage of adjacent heap bytes into the decoded image.

Root Cause

The defect is an input validation error in the XWD parser. Each header parameter passes its individual sanity check, yet the parser never enforces the invariant width * bytes_per_pixel <= bytes_per_line and never validates the total buffer requirement against the allocation. This mismatch between validated inputs and actual memory bounds produces the out-of-bounds read [CWE-125].

Attack Vector

Exploitation requires local access and user interaction. An attacker delivers a crafted XWD file through email, download, or shared storage. When the victim opens the file in GIMP, the file-xwd plugin parses the malformed headers and triggers the out-of-bounds read. The attack does not require authentication to the target system, but the user must actively open the file. Impact is bounded by the local scope and the read-only nature of the memory access.

See the Red Hat CVE Advisory and GitLab GIMP Work Item #16583 for upstream technical detail.

Detection Methods for CVE-2026-80101

Indicators of Compromise

Unexpected GIMP process crashes correlated with opening .xwd files
XWD files with header fields where bytes_per_line is inconsistent with declared width and pixel depth
Rendered output from XWD imports containing apparent random pixel noise at image edges, suggesting leaked heap contents

Detection Strategies

Inspect XWD headers before opening and reject files where width * bytes_per_pixel exceeds bytes_per_line
Enable AddressSanitizer (ASan) or similar runtime instrumentation on GIMP builds used in analysis pipelines to surface out-of-bounds reads
Monitor endpoint telemetry for GIMP process termination signals (SIGSEGV) following image file opens

Monitoring Recommendations

Alert on repeated GIMP crashes on the same host within short time windows
Log file provenance for XWD files entering the environment through email gateways and file shares
Track GIMP versions across the fleet to identify hosts still running unpatched builds

How to Mitigate CVE-2026-80101

Immediate Actions Required

Update GIMP to the fixed release published by the GNOME project once available; track the GitLab GIMP Work Item #16583 for status
Apply distribution updates for GIMP packages when they ship, referencing the Red Hat CVE Advisory
Avoid opening XWD files from untrusted sources until patches are deployed

Patch Information

Upstream fix development is tracked in GitLab GIMP Work Item #16583. Red Hat tracks distribution impact in Bug Report #2523738. Apply vendor updates when they are released for your distribution.

Workarounds

Disable or remove the file-xwd plugin from GIMP installations that do not require XWD support
Convert XWD files to safer formats such as PNG using an isolated, sandboxed converter before opening in GIMP
Restrict GIMP execution to sandboxed environments such as Flatpak with limited filesystem access to contain any information disclosure

bash

# Remove the vulnerable plugin (path may vary by distribution)
sudo rm /usr/lib/gimp/2.0/plug-ins/file-xwd/file-xwd

# Verify plugin is no longer loaded
gimp --version && gimp -b '(car (gimp-version))' -b '(gimp-quit 0)'