CVE-2026-6695
Received Received - Intake

Heap-based Out-of-Bounds Write in GIMP PAA Plugin

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: Red Hat, Inc.

Description
A flaw was found in GIMP. A remote attacker could exploit this by tricking a user into opening a specially crafted PAA (Paint Shop Pro Array) image file. This vulnerability, a heap-based out-of-bounds write in the decode_lzss() function of the PAA file format plugin, allows data to be written beyond the intended memory buffer. This could lead to heap metadata corruption and potentially enable the attacker to execute arbitrary code on the affected system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-03
AI Q&A
2026-08-03
EPSS Evaluated
N/A
NVD
CVE-2026-6695
EUVD
EUVD-2026-52151

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gnome gimp *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-805 The product uses a sequential operation to read or write a buffer, but it uses an incorrect length value that causes it to access memory that is outside of the bounds of the buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a heap-based out-of-bounds write vulnerability in GIMP. It occurs when processing a specially crafted PAA image file. The flaw is in the decode_lzss() function of the PAA file format plugin, which allows writing data beyond the intended memory buffer. This can corrupt heap metadata and potentially lead to arbitrary code execution.

Detection Guidance

Detecting this vulnerability requires checking for GIMP installations and monitoring for suspicious PAA file processing. Inspect GIMP versions for affected releases and scan systems for unusual memory corruption events during image processing. No specific commands are provided in the context.

Impact Analysis

If exploited, this vulnerability could allow an attacker to execute arbitrary code on your system. This might lead to unauthorized access, data theft, or system compromise. The attack requires tricking you into opening a malicious PAA file, so caution with file sources is advised.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a technical flaw in GIMP that could allow arbitrary code execution via a crafted PAA file, which primarily impacts system integrity and availability. Compliance impacts would depend on how the vulnerability is exploited in a specific environment.

Mitigation Strategies

Update GIMP to the latest patched version immediately. Avoid opening untrusted PAA files. Disable the PAA plugin if updates are unavailable. Monitor systems for signs of exploitation or memory corruption.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-6695. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart