CVE-2026-82328: GIMP file-ico Plugin DOS Vulnerability

CVE-2026-82328 Overview

A heap out-of-bounds read vulnerability affects the file-ico plugin in GIMP. The plugin fails to properly validate the used_clrs (palette count) parameter when parsing specially crafted ICO image files. This improper validation causes incorrect memory bounds checking during palette processing, leading to a heap out-of-bounds read. Successful exploitation can crash the GIMP application, resulting in denial of service, or disclose limited amounts of adjacent heap memory contents. The vulnerability requires local file access and user interaction, since the victim must open a malicious ICO file in GIMP. The issue is tracked under [CWE-125: Out-of-bounds Read].

Critical Impact
Opening a crafted ICO file in GIMP can crash the application or leak heap memory contents to an attacker who controls the input file.

Affected Products

GIMP (GNU Image Manipulation Program) file-ico plugin
Red Hat Enterprise Linux 6, 7, 8, and 9 (GIMP package)
Downstream Linux distributions shipping the vulnerable GIMP build

Discovery Timeline

2026-08-28 - CVE-2026-82328 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-82328

Vulnerability Analysis

The flaw resides in the ICO file parser inside GIMP's file-ico plugin. ICO files contain header fields that describe palette entries used to render indexed-color images. The plugin reads the used_clrs field from the file to determine how many palette entries to process. It does not verify that this value stays within the size of the allocated palette buffer before iterating over entries. When the attacker supplies a used_clrs value larger than the actual buffer, the read loop crosses the allocation boundary and accesses adjacent heap memory. The resulting behavior depends on what lies past the buffer: the process may crash with a segmentation fault, or the plugin may consume the out-of-bounds bytes as palette data and render them into a decoded image the user can view.

Root Cause

The root cause is missing input validation on an attacker-controlled length field. The plugin trusts the used_clrs value from the ICO header and uses it directly as a loop bound without cross-checking it against the palette allocation size. This pattern maps to [CWE-125] (Out-of-bounds Read) caused by improper bounds checking of untrusted image metadata.

Attack Vector

Exploitation requires the target user to open a malicious ICO file locally in GIMP. Attackers can deliver the file through email attachments, download links, shared network drives, or image asset bundles. Network-based exploitation is not possible without user interaction. The primary outcomes are process crash (denial of service) and limited disclosure of heap memory that may include pointers, cached image data, or other allocator artifacts.

No verified exploit code is publicly available. See the GNOME GIMP Work Item #16585 and Red Hat Bug Report #2525612 for upstream technical discussion.

Detection Methods for CVE-2026-82328

Indicators of Compromise

Unexpected GIMP process crashes with SIGSEGV immediately after opening an ICO file
ICO files whose header declares a used_clrs value inconsistent with the file's actual palette size
Core dumps or crash reports referencing the file-ico plugin call path

Detection Strategies

Scan file repositories and mail gateways for ICO files with malformed palette metadata using format-aware parsers
Monitor endpoints for repeated GIMP crashes correlated with recently accessed image files
Alert on GIMP child processes producing core files, then triage the associated input file

Monitoring Recommendations

Collect crash telemetry (abrt, systemd-coredump, Windows Error Reporting) from workstations running GIMP
Log file-open events for GIMP to correlate crashes with the originating ICO file path and source
Track GIMP package versions across the fleet to identify hosts still running vulnerable builds

How to Mitigate CVE-2026-82328

Immediate Actions Required

Update GIMP to the patched version distributed by your Linux vendor or the GNOME project as soon as it is available
On Red Hat Enterprise Linux, apply updates referenced in the Red Hat CVE-2026-82328 Advisory
Instruct users not to open ICO files received from untrusted sources until patches are deployed

Patch Information

Monitor the upstream fix tracked in GNOME GIMP Work Item #16585 and vendor advisories for backported patches. Red Hat tracks fix availability across RHEL 6, 7, 8, and 9 in Bugzilla #2525612. Apply distribution updates through the standard package manager once fixes are shipped.

Workarounds

Avoid opening ICO files from untrusted sources in GIMP until the patch is applied
Convert ICO files to another format using a hardened converter in a sandboxed environment before editing in GIMP
Run GIMP under a mandatory access control profile (SELinux, AppArmor, Firejail) to limit the impact of a crash or memory disclosure

bash

# Example: check the installed GIMP version and refresh from vendor repositories on RHEL
rpm -q gimp
sudo dnf --refresh update gimp

# Example: launch GIMP inside a Firejail sandbox to constrain the process
firejail --private --net=none gimp