Heap Out-of-Bounds Read in GIMP XWD Plugin

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: redhat-SADP

Description

A flaw was found in the file-xwd plugin in GIMP. When processing a specially crafted XWD image file, the plugin validates the image width and bytes-per-line parameters independently rather than ensuring their combined values are consistent with the allocated buffer size. This incorrect validation leads to improper bounds checking, causing a heap out-of-bounds read. This issue can result in an application crash, leading to a denial of service, or a limited information disclosure of heap memory contents into the produced image.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-25

Last Modified

2026-08-25

Generated

2026-08-26

AI Q&A

2026-08-26

EPSS Evaluated

N/A

NVD

CVE-2026-80101

Affected Vendors & Products

Vendor	Product	Version / Range
gnome	gimp	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is a flaw in GIMP's file-xwd plugin. When processing a specially crafted XWD image file, the plugin checks image width and bytes-per-line separately instead of verifying they fit within the allocated buffer. This causes a heap out-of-bounds read, potentially leading to application crashes or limited information disclosure from heap memory into the image.

Impact Analysis

This flaw may cause GIMP to crash, resulting in a denial of service. It could also expose limited heap memory contents in the processed image, posing a minor risk of information disclosure.

Mitigation Strategies

Update GIMP to the latest version to ensure the file-xwd plugin has the proper bounds checking fix. Avoid opening untrusted XWD image files until the update is applied.

Hi! I’m here to help you understand CVE-2026-80101. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70