---
id: CVE-2026-6694
title: 'Gimp: gimp file-png plugin: denial of service via oversized apng trns chunk'
summary: >-
  A flaw was found in GIMP's file-png plugin. A remote attacker can exploit this
  by crafting a malicious Animated Portable Network Graphics (APNG) image
  containing an oversized tRNS chunk. This can lead to a stack-based buffer
  overflow (CW…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-120
vendor: Red Hat
product: gimp
affected:
  - gimp (all versions)
  - gimp (all versions)
  - 'gimp:2.8/gimp (all versions)'
  - gimp (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-08-03T13:48:05.346702Z'
published: '2026-08-03'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T22:11:34.310Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-6694'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-6694'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2459779'
    label: RHBZ#2459779
tags:
  - cve.org
epss: 0.00202
epssPercentile: 0.1029
ingestedAt: '2026-11-05T23:41:31.955Z'
---

## Overview

A flaw was found in GIMP's file-png plugin. A remote attacker can exploit this by crafting a malicious Animated Portable Network Graphics (APNG) image containing an oversized tRNS chunk. This can lead to a stack-based buffer overflow (CWE-121), causing the file-png plugin to crash and resulting in a Denial of Service (DoS) for the user.

## Affected

- `gimp (all versions)`
- `gimp (all versions)`
- `gimp:2.8/gimp (all versions)`
- `gimp (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

To mitigate this issue, avoid opening or processing untrusted APNG (Animated Portable Network Graphics) image files with GIMP. Since the vulnerability is triggered by malformed APNG content, restricting interaction with such files will prevent the `file-png` plugin from crashing. If the plugin crashes, restarting GIMP may be necessary to restore full functionality.