{"id":"CVE-2026-66759","title":"Gimp: out-of-bounds read in file-icns plugin causes information disclosure or crash on crafted icns images","summary":"A flaw was found in the file-icns plugin in GIMP. When applying a decompressed mask during ICNS image processing, the plugin reads from the mask data buffer without verifying if the cursor exceeds the allocated resource size. If a crafte…","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","cvssSource":"cna","cwe":["CWE-125"],"vendor":"GNOME","product":"gimp","affected":["gimp >= 2.99.14 < *","gimp (all versions)","gimp","gimp","gimp:2.8/gimp"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-07-27T19:25:27.419672Z"},"exploitAvailable":true,"published":"2026-07-27","updated":"2026-11-05","sourceUpdated":"2026-11-05T22:13:21.283Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-66759","references":[{"url":"https://access.redhat.com/errata/RHSA-2026:50817","label":"RHSA-2026:50817"},{"url":"https://access.redhat.com/security/cve/CVE-2026-66759"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2507557","label":"RHBZ#2507557"},{"url":"https://gitlab.gnome.org/GNOME/gimp/-/issues/16528"}],"tags":["cve.org","exploit-available"],"epss":0.00305,"epssPercentile":0.23449,"ingestedAt":"2026-11-05T23:41:31.952Z","slug":"CVE-2026-66759","body":"## Overview\n\nA flaw was found in the file-icns plugin in GIMP. When applying a decompressed mask during ICNS image processing, the plugin reads from the mask data buffer without verifying if the cursor exceeds the allocated resource size. If a crafted file contains a truncated mask resource, the icns_decompress function continues reading past the bounds of the buffer. This out-of-bounds read vulnerability results in information disclosure of heap contents, where memory contents are leaked as alpha channel pixel values, or a crash leading to a denial of service if unmapped memory is accessed.\n\n## Affected\n\n- `gimp >= 2.99.14 < *`\n- `gimp (all versions)`\n- `gimp`\n- `gimp`\n- `gimp:2.8/gimp`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nTo mitigate this vulnerability, do not open ICNS files from untrusted sources with GIMP.","depth":"midnight","depthScore":51,"depthScoreParts":{"impact":39.1,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[]}