HEAP Buffer Overflow Vulnerability in GIMP Affects Remote Code Execution
CVE-2026-2047

7.8HIGH

Key Information:

Vendor

Gimp

Status
Gimp
Vendor
CVE Published:
20 February 2026

What is CVE-2026-2047?

This vulnerability arises from improper validation during the parsing of ICNS files in GIMP, which can lead to a heap-based buffer overflow. An attacker can exploit this flaw by tricking users into opening a malicious file or visiting a compromised webpage. Once the malformed ICNS file is processed, it allows for arbitrary code execution within the context of the affected GIMP installation, potentially compromising system stability and security.

Affected Version(s)

GIMP 3.0.6

References

https://www.zerodayinitiative.com/advisories/ZDI-26-120/
x_research-advisory
https://gitlab.gnome.org/GNOME/gimp/-/merge_requests/2600...
vendor-advisory

CVSS V3.0

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.