GIMP (All Versions Prior to Fix) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/gimp-all-versions-prior-to-fix/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 14 Sep 2026 17:34:53 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgOut-of-Bounds Write Vulnerability in GIMP Lighting Effects Filter (CVE-2026-90947)https://feed.craftedsignal.io/briefs/2026-09-gimp-oob-write/Mon, 14 Sep 2026 17:34:53 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-gimp-oob-write/GIMP contains an out-of-bounds write vulnerability in its Lighting Effects filter, allowing potential arbitrary code execution when processing a maliciously crafted lighting preset file.A memory corruption vulnerability (CVE-2026-90947) has been identified in the GIMP image manipulation software. The flaw resides within the Lighting Effects filter, which fails to correctly validate the number of light sources defined within a GIMP lighting preset file. When a user opens a specially crafted preset file containing an unexpected number of light sources, the application performs an out-of-bounds write operation, leading to memory corruption. This vulnerability exposes users to potential application crashes or, in specific scenarios, arbitrary code execution in the context of the user running the application. This issue impacts GIMP across all supported platforms, including Windows, Linux, and macOS. Defenders should prioritize patching GIMP versions to the latest available release as identified by the project's security advisories.

Impact

Successful exploitation of CVE-2026-90947 could lead to full compromise of the user account running GIMP. This threat is particularly relevant in environments where users frequently import or share graphical design presets. If the application is running with elevated privileges, the impact of arbitrary code execution is significantly magnified. There is currently no report of large-scale exploitation in the wild, but the nature of the flaw makes it a viable candidate for targeted social engineering attacks.

Recommendation

  1. Upgrade all instances of GIMP to the latest version provided by the GIMP development team that addresses CVE-2026-90947.
  2. Implement application allowlisting or restricted execution policies for image processing software to limit the impact of potential arbitrary code execution.
  3. Educate users regarding the risks of opening external preset files or image configuration files from untrusted sources.
]]>highthreat