CVE-2026-2272
Integer Overflow in GIMP ICO Processing Causes Buffer Overflow
Publication date: 2026-03-26
Last updated on: 2026-04-03
Assigner: Red Hat, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| redhat | enterprise_linux | 7.0 |
| redhat | enterprise_linux | 6.0 |
| redhat | enterprise_linux | 8.0 |
| redhat | enterprise_linux | 9.0 |
| gimp | gimp | 3.0.6 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-190 | The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an integer overflow flaw in GIMP when processing ICO image files. It occurs because the size calculation for image buffers uses 32-bit integers that can wrap around if the image header dimensions are very large. Specifically, the functions `ico_read_info` and `ico_read_icon` handle image size differently, causing a mismatch that allows oversized image headers to bypass security checks.
As a result, the program may allocate a buffer that is too small, but then write data beyond this buffer during image decoding, leading to memory corruption.
A remote attacker can exploit this by providing a specially crafted ICO file with large dimensions, triggering the overflow and causing a buffer overflow.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.
How can this vulnerability impact me? :
Exploitation of this vulnerability can lead to memory corruption in the GIMP application.
The primary impact is an application-level denial of service, where GIMP may crash or become unstable when processing malicious ICO files.
There is no indication from the provided information that this vulnerability allows code execution or data disclosure, but the memory corruption could potentially be leveraged for further attacks.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by identifying attempts to open or process specially crafted ICO files with oversized BITMAPINFOHEADER dimensions that cause integer overflow during image buffer size calculations.
To detect exploitation attempts on your system, you can monitor GIMP process crashes or memory corruption events when handling ICO files.
You may also scan files for suspicious ICO headers with abnormally large width and height values, such as width = 0x00100000 and height = 0x00200000, which are known to trigger this vulnerability.
While no specific commands are provided in the resources, you can use tools like 'file' or 'identify' (from ImageMagick) to inspect ICO files, and monitor system logs for GIMP crashes.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include avoiding opening or processing untrusted or suspicious ICO image files with GIMP.
Apply any available patches or updates from your Linux distribution or GIMP maintainers that address this integer overflow vulnerability.
If patches are not yet available, consider restricting or monitoring the use of GIMP on systems where exposure to untrusted ICO files is possible.