CVE-2026-66759
Awaiting Analysis Awaiting Analysis - Queue

Out-of-Bounds Read in GIMP File-ICNS Plugin

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: Red Hat, Inc.

Description
A flaw was found in the file-icns plugin in GIMP. When applying a decompressed mask during ICNS image processing, the plugin reads from the mask data buffer without verifying if the cursor exceeds the allocated resource size. If a crafted file contains a truncated mask resource, the icns_decompress function continues reading past the bounds of the buffer. This out-of-bounds read vulnerability results in information disclosure of heap contents, where memory contents are leaked as alpha channel pixel values, or a crash leading to a denial of service if unmapped memory is accessed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-07-28
AI Q&A
2026-07-27
EPSS Evaluated
N/A
NVD
CVE-2026-66759
EUVD
EUVD-2026-49405

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
gimp gimp *
gnome gimp From 2.99.14 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an out-of-bounds read flaw in GIMP's file-icns plugin. When processing ICNS images, the plugin reads from a mask data buffer without verifying if the cursor stays within allocated memory. If a crafted file has a truncated mask, the function continues reading past buffer limits, leaking heap memory as pixel values or crashing the program.

Detection Guidance

Detecting this vulnerability requires checking for vulnerable GIMP versions and analyzing ICNS image processing. Inspect installed GIMP versions with 'gimp --version' and verify if it is 2.99.14 or newer. Monitor for crashes or memory leaks when processing ICNS files. Use tools like 'valgrind' to detect out-of-bounds reads during image processing.

Impact Analysis

An attacker could exploit this to leak sensitive memory contents, including potentially confidential data, or crash GIMP, causing a denial of service. This requires user interaction, such as opening a malicious ICNS file.

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by enabling information disclosure through heap memory leaks. If exploited, it may expose sensitive data processed by GIMP, such as alpha channel pixel values, which could include personal or health-related information. This could lead to unauthorized data exposure, violating GDPR's data protection principles or HIPAA's confidentiality requirements.

Mitigation Strategies

Update GIMP to the latest version where this flaw is patched. Avoid opening untrusted ICNS files until the update is applied. If immediate patching is not possible, disable the file-icns plugin or restrict access to GIMP for untrusted users.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66759. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart