CVE-2026-58380

Modified Modified - Updated After Analysis

Buffer Overflow in GIMP PNM Parser

Publication date: 2026-07-06

Last updated on: 2026-07-16

Assigner: Red Hat, Inc.

Description

A flaw was found in GIMP's PNM file format parser. When parsing a specially crafted PNM file, the pnmscanner_gettoken() function writes a null terminator one byte past the end of a stack-allocated buffer due to an off-by-one error in the loop boundary check. This could lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-06

Last Modified

2026-07-16

Generated

2026-07-28

AI Q&A

2026-07-06

EPSS Evaluated

2026-07-26

NVD

CVE-2026-58380

EUVD

EUVD-2026-41875

Affected Vendors & Products

Vendor	Product	Version / Range
redhat	enterprise_linux	7.0
redhat	enterprise_linux	8.0
redhat	enterprise_linux	9.0
gimp	gimp	3.2.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-193	A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.

Attack-Flow Graph

Executive Summary

CVE-2026-58380 is a security vulnerability in GIMP's PNM file format parser. It is caused by an off-by-one error in the pnmscanner_gettoken() function, where a null terminator is written one byte past the end of a stack-allocated buffer. This happens because the buffer has a fixed size of 512 bytes and the loop boundary check allows the index to reach the buffer size limit, causing a one-byte overflow.

This overflow can lead to memory corruption when processing specially crafted PNM files.

Detection Guidance

This vulnerability is triggered when GIMP processes specially crafted PNM files that exploit a stack buffer overflow in the pnmscanner_gettoken() function. Detection involves monitoring for suspicious or malformed PNM files being opened or processed by GIMP.

Since the issue is related to file parsing within GIMP, network detection might focus on identifying the transfer or presence of suspicious PNM files.

No specific detection commands or signatures are provided in the available resources.

Impact Analysis

The vulnerability can lead to memory corruption, which may result in denial of service (crashes) or arbitrary code execution. This means an attacker could potentially execute malicious code on your system by tricking GIMP into processing a specially crafted PNM file.

Compliance Impact

There is no information provided in the available context or resources about how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.

Mitigation Strategies

The primary mitigation step is to update GIMP to a version that includes the upstream fix for this vulnerability.

Until the update is applied, avoid opening or processing untrusted or suspicious PNM files with GIMP to prevent triggering the vulnerability.

Additionally, applying standard security practices such as running GIMP with least privileges and monitoring for abnormal crashes can help reduce risk.

Hi! I’m here to help you understand CVE-2026-58380. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70