Red Hat Enterprise Linux 6 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/red-hat-enterprise-linux-6/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 06 Jul 2026 15:25:56 +0000CVE-2026-58380: GIMP PNM Parser Off-by-One Error Leads to RCEhttps://feed.craftedsignal.io/briefs/2026-07-cve-2026-58380-gimp-pnm-parser-vulnerability/Mon, 06 Jul 2026 15:25:56 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-cve-2026-58380-gimp-pnm-parser-vulnerability/A high-severity off-by-one error, CVE-2026-58380, in GIMP's PNM file format parser (specifically the `pnmscanner_gettoken()` function) allows an attacker to corrupt memory by crafting a malicious PNM file, potentially leading to denial of service or arbitrary code execution when the file is opened.CVE-2026-58380 details a critical vulnerability discovered in GIMP's PNM (Portable Anymap) image file format parser. The flaw resides within the pnmscanner_gettoken() function, where an off-by-one error during a loop boundary check causes a null terminator to be written one byte beyond the intended boundary of a stack-allocated buffer. This memory corruption is triggered when GIMP attempts to parse a specially crafted PNM file. While not yet observed in active exploitation, successful exploitation could lead to application instability and denial of service due to crashes, or, more severely, arbitrary code execution, granting an attacker control over the compromised system. This vulnerability affects various GIMP versions, including those shipped with Red Hat Enterprise Linux distributions.

Attack Chain

  1. An attacker crafts a malicious PNM image file specifically designed to exploit the off-by-one error in GIMP's pnmscanner_gettoken() function.
  2. The malicious PNM file is delivered to a victim through common vectors such as email attachments, malicious websites, or untrusted file shares.
  3. The victim opens the specially crafted PNM file using the vulnerable GIMP application.
  4. During the file parsing process, the pnmscanner_gettoken() function attempts to process the malicious input.
  5. The off-by-one error causes a null byte to be written past the end of a stack buffer, corrupting adjacent memory.
  6. This memory corruption disrupts program execution flow, leading to either an immediate application crash (denial of service) or, under controlled conditions, enables arbitrary code execution on the victim's system.

Impact

The vulnerability, CVE-2026-58380, carries a CVSS v3.1 Base Score of 7.3 (High), indicating significant potential impact. If successfully exploited, systems running vulnerable versions of GIMP could suffer from denial of service, where the application crashes, leading to loss of productivity. More critically, an attacker could achieve arbitrary code execution, allowing them to install malware, exfiltrate data, or gain full control over the compromised system. While there are no reports of in-the-wild exploitation, the widespread use of GIMP, particularly on Linux distributions like Red Hat Enterprise Linux, makes this a high-risk vulnerability.

Recommendation

  • Apply available patches for CVE-2026-58380 immediately to all GIMP installations, particularly on Red Hat Enterprise Linux systems, by referring to the official Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-58380.
  • Monitor Red Hat security channels for updates to affected products as detailed in the Red Hat advisory and apply them promptly.
  • Implement user awareness training regarding the risks associated with opening untrusted image files, especially those in less common formats like PNM.
]]>highthreatvulnerabilitymemory-corruptionbuffer-overflowGIMPlinux