CVE-2026-90947: GIMP Lighting Effects RCE Vulnerability

CVE-2026-90947 Overview

CVE-2026-90947 is an out-of-bounds write vulnerability [CWE-787] in the GNU Image Manipulation Program (GIMP). The flaw resides in the Lighting Effects filter, which fails to properly validate the number of light sources when parsing a lighting preset file. Processing a malicious preset triggers memory corruption in the filter's internal buffers. An attacker who convinces a user to open a crafted preset file can cause a crash or achieve arbitrary code execution in the context of the GIMP process.

Critical Impact
Successful exploitation grants local code execution with the privileges of the user running GIMP, enabling downstream compromise of the workstation.

Affected Products

GNU Image Manipulation Program (GIMP)
GIMP Lighting Effects filter component
Downstream distributions packaging affected GIMP builds (see Red Hat advisory)

Discovery Timeline

2026-09-14 - CVE-2026-90947 published to the National Vulnerability Database (NVD)
2026-09-17 - CVE-2026-90947 last updated in NVD

Technical Details for CVE-2026-90947

Vulnerability Analysis

The defect lives in GIMP's Lighting Effects filter, which supports importing preset files that describe scene lighting parameters. The filter reads a light-source count from the preset and iterates over per-light structures without bounding the count against the fixed-size destination buffer. When the count exceeds the allocated capacity, subsequent writes spill past the end of the buffer, overwriting adjacent heap or stack memory.

This corruption pattern is characteristic of [CWE-787] Out-of-Bounds Write conditions. Attackers can shape the overflowing data to overwrite function pointers, virtual table entries, or heap metadata. Because GIMP runs in the desktop session of the invoking user, successful exploitation yields code execution at that user's privilege level. The condition also produces reliable crashes, providing a low-effort denial-of-service path even without weaponized payloads.

Root Cause

The root cause is missing input validation. The Lighting Effects preset parser trusts the light-source count field supplied by the file and does not verify it against the destination array size before writing each entry. This omission converts a data-driven configuration option into a memory-safety failure.

Attack Vector

Exploitation requires local file access and user interaction. An attacker delivers a crafted .gimp lighting preset through email, chat, a shared drive, or a compromised website. When the user opens the preset within the Lighting Effects dialog, GIMP parses the file and triggers the out-of-bounds write. No network exposure or elevated privileges are required to reach the vulnerable code path.

No verified proof-of-concept has been published. Technical details are described in prose only. Refer to the GIMP Work Item #16682 and the Red Hat Bug Report #2533005 for upstream discussion.

Detection Methods for CVE-2026-90947

Indicators of Compromise

Unexpected GIMP process crashes accompanied by segmentation fault entries in system logs or coredumpctl records
Lighting preset files arriving from untrusted sources, particularly with anomalously large light-source counts
Child processes spawned by gimp that are inconsistent with normal image-editing workflows, such as shells or scripting interpreters

Detection Strategies

Hunt for GIMP processes that spawn command interpreters (sh, bash, powershell) or network utilities shortly after opening a document
Inspect user download directories and mail attachments for lighting preset files sourced externally
Correlate GIMP crash telemetry with recent file-open events to identify potential exploitation attempts

Monitoring Recommendations

Enable endpoint process-lineage telemetry to record parent-child relationships originating from gimp
Forward application crash events to a central log platform for retrospective analysis
Track file writes and reads from GIMP against a baseline of expected project directories

How to Mitigate CVE-2026-90947

Immediate Actions Required

Instruct users to avoid opening lighting preset files received from untrusted sources until a patched GIMP build is deployed
Inventory workstations running GIMP and prioritize patch deployment for creative and design teams
Restrict execution of GIMP on high-value systems where image editing is not required

Patch Information

Monitor the GIMP Work Item #16682 and the Red Hat CVE Advisory for the fixed release and distribution-specific package updates. Apply vendor patches as soon as they become available through official package channels.

Workarounds

Disable use of the Lighting Effects filter in shared or automated workflows until patched builds are installed
Block delivery of GIMP preset file attachments at the mail gateway for users who do not require them
Run GIMP under a standard (non-administrative) user account to limit the blast radius of successful exploitation

bash

# Configuration example
# Verify installed GIMP version and check for updates on Debian/Ubuntu
dpkg -l | grep -i gimp
sudo apt update && sudo apt upgrade gimp

# On Red Hat / Fedora systems
rpm -q gimp
sudo dnf update gimp