Heap-based Buffer Overflows in GIMP APNG and DDS Loaders

The GNU Image Manipulation Program (GIMP) contains two distinct heap-based buffer overflow vulnerabilities identified as CVE-2026-42169. The first vulnerability resides in the APNG (Animated PNG) file loader, triggered when the fcTL (frame control) width value exceeds the IHDR (image header) width, causing the application to write pixel data beyond the allocated heap buffer. The second vulnerability occurs in the DDS (DirectDraw Surface) plug-in due to a bits-per-pixel (BPP) mismatch within the load_layer() function during image processing. An attacker can exploit these flaws by delivering a malicious image file to a target user and inducing them to open it within the GIMP application. Successful exploitation of these memory corruption vulnerabilities may result in arbitrary code execution within the context of the user running the application.

Impact

Successful exploitation allows for arbitrary code execution on systems running vulnerable versions of GIMP, including Red Hat Enterprise Linux 9. The impact involves potential system compromise, data theft, and unauthorized access to the local user's workstation. These vulnerabilities require user interaction, specifically the opening of a crafted file, which limits the automated spread but poses significant risks in environments where users frequently process external or untrusted media files.

Recommendation

Prioritize the identification and patching of GIMP installations across all enterprise endpoints. Since no direct network-based indicator exists, focus on software inventory management.

• Audit all endpoints to identify installations of GIMP and update to the latest version providing the fix for CVE-2026-42169.
• Implement application control policies to restrict the execution of image editing software to authorized personnel, minimizing the attack surface.
• Monitor for GIMP process execution (e.g., gimp.exe or gimp) alongside child processes that deviate from standard behavior, as these may indicate exploitation of memory corruption vulnerabilities.