Remote Code Execution Vulnerability in GIMP Software by GNOME
CVE-2026-2045

7.8HIGH

Key Information:

Vendor

Gimp

Status
Gimp
Vendor
CVE Published:
20 February 2026

What is CVE-2026-2045?

The vulnerability in GIMP arises from improper validation of user-supplied data when parsing XWD files. This oversight can lead to out-of-bounds write conditions, allowing remote attackers to execute arbitrary code on affected installations. To exploit this flaw, a user must either visit a malicious webpage or open an infected XWD file, enabling an attacker to execute code within the context of the current process.

Affected Version(s)

GIMP 3.0.6

References

https://www.zerodayinitiative.com/advisories/ZDI-26-119/
x_research-advisory
https://gitlab.gnome.org/GNOME/gimp/-/commit/68b27dfb1cbd...
vendor-advisory

EPSS Score

5% chance of being exploited in the next 30 days.

CVSS V3.0

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.