Out-of-Bounds Read Flaw in GIMP's File-ICNS Plugin
CVE-2026-66759
7.1HIGH
What is CVE-2026-66759?
The file-icns plugin in GIMP has a flaw that occurs when processing ICNS images using a decompressed mask. Specifically, during this process, the plugin does not check if the cursor exceeds the allocated memory size, allowing it to read beyond the buffer limits. If an attacker crafts an ICNS file that contains a truncated mask resource, this vulnerability can lead to the icns_decompress function reading past the intended memory bounds. Consequently, sensitive memory contents may be leaked, manifesting as alpha channel pixel values, or the application may experience a crash, resulting in a denial of service if it attempts to access unmapped memory.
References
CVSS V3.1
Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Red Hat would like to thank Tristan Madani for reporting this issue.