{"id":"CVE-2026-6694","title":"Gimp: gimp file-png plugin: denial of service via oversized apng trns chunk","summary":"A flaw was found in GIMP's file-png plugin. A remote attacker can exploit this by crafting a malicious Animated Portable Network Graphics (APNG) image containing an oversized tRNS chunk. This can lead to a stack-based buffer overflow (CW…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-120"],"vendor":"Red Hat","product":"gimp","affected":["gimp (all versions)","gimp (all versions)","gimp:2.8/gimp (all versions)","gimp (all versions)"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-08-03T13:48:05.346702Z"},"published":"2026-08-03","updated":"2026-11-05","sourceUpdated":"2026-11-05T22:11:34.310Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-6694","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-6694"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2459779","label":"RHBZ#2459779"}],"tags":["cve.org"],"epss":0.00202,"epssPercentile":0.1029,"ingestedAt":"2026-11-05T23:41:31.955Z","slug":"CVE-2026-6694","body":"## Overview\n\nA flaw was found in GIMP's file-png plugin. A remote attacker can exploit this by crafting a malicious Animated Portable Network Graphics (APNG) image containing an oversized tRNS chunk. This can lead to a stack-based buffer overflow (CWE-121), causing the file-png plugin to crash and resulting in a Denial of Service (DoS) for the user.\n\n## Affected\n\n- `gimp (all versions)`\n- `gimp (all versions)`\n- `gimp:2.8/gimp (all versions)`\n- `gimp (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nTo mitigate this issue, avoid opening or processing untrusted APNG (Animated Portable Network Graphics) image files with GIMP. Since the vulnerability is triggered by malformed APNG content, restricting interaction with such files will prevent the `file-png` plugin from crashing. If the plugin crashes, restarting GIMP may be necessary to restore full functionality.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}