---
id: CVE-2026-92183
title: >-
  gimp: gimp: Arbitrary code execution via stack-based buffer overflow in APNG
  parser (CVE-2026-92183)
summary: >-
  A flaw was found in GIMP. This flaw allows an attacker to achieve arbitrary
  code execution by tricking a user into opening a specially crafted Animated
  Portable Network Graphics (APNG) image. The vulnerability is caused by a
  stack-based bu…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cvssSource: vendor
cwe:
  - CWE-120
  - CWE-121
vendor: Red Hat
product: Red Hat Enterprise Linux 8
affected:
  - enterprise_linux 6
  - enterprise_linux 7
  - enterprise_linux 8
  - enterprise_linux 9
published: '2026-10-21'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T15:54:38+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-92183.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-92183.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-92183'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2558400'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-92183'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92183'
  - url: >-
      https://gitlab.gnome.org/GNOME/gimp/-/commit/175e28961a4679be8762a2d4d5a297faa82aebd9
  - url: 'https://www.zerodayinitiative.com/advisories/ZDI-26-713/'
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
epss: 0.00434
epssPercentile: 0.37462
zeroDay: true
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-22T23:04:57.084779Z'
ingestedAt: '2026-10-21T18:09:27.280Z'
---

## Overview

A flaw was found in GIMP. This flaw allows an attacker to achieve arbitrary code execution by tricking a user into opening a specially crafted Animated Portable Network Graphics (APNG) image. The vulnerability is caused by a stack-based buffer overflow resulting from improper validation of data length during APNG file parsing.

## Vendor advisories

- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-92183.json)

**gimp: gimp: Arbitrary code execution via stack-based buffer overflow in APNG parser** — rated Important by Red Hat. Released 2026-10-21, updated 2026-10-23.

Affected:

- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9

No fix planned:

- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9

Not affected:

- Red Hat Enterprise Linux 10

## Remediation

Affected

Workarounds / mitigations:

- 1. Summary of action:
Remove the optional GIMP package on systems where graphical image editing is not required, or implement operational controls to avoid processing untrusted image files.

2. Command example:
To remove the package on Red Hat Enterprise Linux:
# dnf remove gimp

3. Caveats:
Removing the GIMP package disables graphical image editing workflows and might trigger the removal of dependent desktop utilities; review transaction dependencies prior to confirmation. In environments wher…