GIMP (File-Icns Plugin) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/gimp-file-icns-plugin/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 27 Jul 2026 19:47:12 +0000CVE-2026-66759: Out-of-Bounds Read in GIMP file-icns Pluginhttps://feed.craftedsignal.io/briefs/2026-07-cve-2026-66759-gimp-oob-read/Mon, 27 Jul 2026 19:47:12 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-cve-2026-66759-gimp-oob-read/A critical out-of-bounds read vulnerability (CVE-2026-66759) has been identified in the GIMP file-icns plugin, where processing a crafted ICNS file with a truncated mask resource can lead to information disclosure of heap contents via leaked alpha channel pixel values or a denial of service due to an application crash.A significant security flaw, CVE-2026-66759, exists within the file-icns plugin of the GIMP image manipulation program. This vulnerability arises during the processing of ICNS image files, specifically when the plugin attempts to apply a decompressed mask. The core issue is an out-of-bounds read condition: if a maliciously crafted ICNS file contains a truncated mask resource, the icns_decompress function fails to verify whether its read cursor exceeds the allocated buffer size. Consequently, the function continues to read past the legitimate memory boundaries. This uncontrolled read can result in two primary impacts: either sensitive heap contents are disclosed, manifesting as leaked alpha channel pixel values within the processed image, or the GIMP application crashes, leading to a denial of service, particularly if the read operation attempts to access unmapped memory regions. The vulnerability is present across GIMP installations on Windows, Linux, and macOS platforms.

Attack Chain

  1. An attacker creates a specially crafted ICNS image file that includes a truncated mask resource.
  2. The attacker delivers the malicious ICNS file to a victim, potentially via email, malicious website download, or other social engineering tactics.
  3. The victim opens the crafted ICNS file using GIMP.
  4. GIMP's file-icns plugin initiates processing of the ICNS image, including attempting to decompress and apply the mask data.
  5. The icns_decompress function, while processing the truncated mask, fails to perform boundary checks and reads beyond the allocated buffer.
  6. This out-of-bounds read either accesses unmapped memory, causing GIMP to crash and resulting in a denial of service, or it leaks sensitive heap contents which can be observed as anomalous alpha channel pixel values within the image data, leading to information disclosure.

Impact

Successful exploitation of CVE-2026-66759 results in either information disclosure or a denial of service. The information disclosure aspect allows an attacker to potentially retrieve sensitive data from the application's heap memory, which could include credentials, session tokens, or other confidential user or system information, displayed as alpha channel pixel values. Alternatively, the vulnerability can cause the GIMP application to crash, rendering it unusable for the victim until restarted. The vulnerability affects users across Windows, Linux, and macOS platforms, impacting any user who processes ICNS files with vulnerable versions of GIMP.

Recommendation

  • Patch CVE-2026-66759 by updating your GIMP installations to a version that addresses this vulnerability immediately.
  • Monitor for unexpected GIMP application crashes or error messages that might indicate attempted exploitation of CVE-2026-66759.
]]>highadvisoryvulnerabilityout-of-bounds-readinformation-disclosuredenial-of-serviceimage-processing