CVE-2026-82328

Analyzed Analyzed - Analysis Complete

Heap Out-of-Bounds Read in GIMP File-ICO Plugin

Publication date: 2026-08-28

Last updated on: 2026-08-31

Assigner: redhat-SADP

Description

A flaw was found in the file-ico plugin in GIMP. When processing a specially crafted ICO image file, the plugin does not properly validate the used_clrs (palette count) parameter. This incorrect validation leads to improper memory bounds checking, resulting in a heap out-of-bounds read. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of heap memory contents.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-31

Generated

2026-09-18

AI Q&A

2026-08-29

EPSS Evaluated

2026-09-15

NVD

CVE-2026-82328

EUVD

EUVD-2026-67725

Affected Vendors & Products

Vendor	Product	Version / Range
gimp	gimp	to 3.3.1 (inc)
redhat	enterprise_linux	7.0
redhat	enterprise_linux	6.0
redhat	enterprise_linux	8.0
redhat	enterprise_linux	9.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is a heap out-of-bounds read flaw in GIMP's file-ico plugin. When processing a specially crafted ICO image file, the plugin fails to validate the used_clrs (palette count) parameter properly. This leads to incorrect memory bounds checking, causing the application to read memory outside its allocated bounds.

Detection Guidance

This vulnerability is triggered by processing a malicious ICO file in GIMP. Detection involves monitoring for crashes when opening ICO files or analyzing GIMP logs for heap out-of-bounds read errors. No specific commands are provided in the context to detect this issue.

Impact Analysis

This issue can crash the GIMP application, resulting in a denial of service. It may also lead to limited disclosure of heap memory contents. Exploitation requires an attacker to trick a user into opening a malicious ICO file.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR or HIPAA. It primarily causes application crashes or limited memory disclosure, which are not direct violations of these standards. However, if exploited, it could lead to unauthorized access to memory contents, potentially affecting data confidentiality. Organizations should still mitigate the risk to prevent potential secondary compliance issues.

Mitigation Strategies

Avoid opening ICO files from untrusted sources in GIMP. Update GIMP to the latest version once a patch is available. Monitor GIMP application crashes when processing ICO files as a potential indicator of exploitation.

Hi! I’m here to help you understand CVE-2026-82328. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70