CVE-2026-6694
Received Received - Intake

Stack-Based Buffer Overflow in GIMP File-PNG Plugin

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: Red Hat, Inc.

Description
A flaw was found in GIMP's file-png plugin. A remote attacker can exploit this by crafting a malicious Animated Portable Network Graphics (APNG) image containing an oversized tRNS chunk. This can lead to a stack-based buffer overflow (CWE-121), causing the file-png plugin to crash and resulting in a Denial of Service (DoS) for the user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-03
AI Q&A
2026-08-03
EPSS Evaluated
N/A
NVD
CVE-2026-6694
EUVD
EUVD-2026-52150

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gnome gimp *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-120 The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a stack-based buffer overflow in GIMP's file-png plugin. It occurs when processing a malicious APNG image with an oversized tRNS chunk. This causes the plugin to crash, leading to a Denial of Service for the user.

Detection Guidance

This vulnerability involves a crafted APNG image triggering a stack-based buffer overflow in GIMP's file-png plugin. Detection requires inspecting files processed by GIMP for oversized tRNS chunks in APNG images. Use tools like 'file' to check image formats and 'hexdump' or 'xxd' to examine PNG chunks for anomalies.

Impact Analysis

If you open a specially crafted APNG image, the vulnerability could crash GIMP, preventing you from using it until you restart the application. It does not allow code execution or data theft.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR, HIPAA, or similar standards as it primarily causes a Denial of Service (DoS) through a crash in GIMP's file-png plugin. No data exposure or confidentiality breach is indicated.

Mitigation Strategies

Update GIMP to the latest version to patch the flaw. Avoid opening untrusted APNG images. Use image viewers or editors with sandboxing capabilities. Monitor GIMP processes for crashes during image processing as a potential indicator of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-6694. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart