CVE-2026-80101

Modified Modified - Updated After Analysis

Heap Out-of-Bounds Read in GIMP XWD Plugin

Publication date: 2026-08-25

Last updated on: 2026-09-02

Assigner: redhat-SADP

Description

A flaw was found in the file-xwd plugin in GIMP. When processing a specially crafted XWD image file, the plugin validates the image width and bytes-per-line parameters independently rather than ensuring their combined values are consistent with the allocated buffer size. This incorrect validation leads to improper bounds checking, causing a heap out-of-bounds read. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of heap memory contents into the produced image.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-25

Last Modified

2026-09-02

Generated

2026-09-15

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-13

NVD

CVE-2026-80101

Affected Vendors & Products

Vendor	Product	Version / Range
gimp	gimp	to 3.3.1 (inc)
redhat	enterprise_linux	7.0
redhat	enterprise_linux	6.0
redhat	enterprise_linux	8.0
redhat	enterprise_linux	9.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is a flaw in GIMP's file-xwd plugin. When processing a specially crafted XWD image file, the plugin checks image width and bytes-per-line separately instead of verifying they fit within the allocated buffer. This causes a heap out-of-bounds read, potentially leading to application crashes or limited information disclosure from heap memory into the image.

Detection Guidance

This vulnerability is specific to the GIMP file-xwd plugin and requires examining image files processed by it. There are no direct network detection commands. To check for potential exploitation, inspect GIMP logs for crashes when opening XWD files or monitor system memory usage during image processing.

Impact Analysis

This flaw may cause GIMP to crash, resulting in a denial of service. It could also expose limited heap memory contents in the processed image, posing a minor risk of information disclosure.

Compliance Impact

This vulnerability primarily causes a heap out-of-bounds read in GIMP's file-xwd plugin, leading to application crashes or limited information disclosure. It does not directly impact compliance with GDPR, HIPAA, or similar standards as it is a local denial-of-service or minor data exposure issue rather than a data breach or unauthorized access scenario.

Mitigation Strategies

Update GIMP to the latest version to ensure the file-xwd plugin has the proper bounds checking fix. Avoid opening untrusted XWD image files until the update is applied.

Hi! I’m here to help you understand CVE-2026-80101. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70