CVE-2026-66758

Gimp: integer overflow in file-fits plugin causes a heap-based buffer overflow on crafted fits images

View on CVE.org
Published Jul 27, 2026 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Description
A flaw was found in the file-fits plugin in GIMP. When processing a FITS image file, the plugin calculates memory allocation sizes using signed 32-bit integers for width and height. If a crafted file sets both values to large values, their product exceeds 2^31 and overflows, resulting in an undersized heap-based buffer allocation. This integer overflow issue results in a heap-based buffer overflow when cfitsio subsequently writes a full row of pixels in the buffer, causing memory corruption, potentially leading to arbitrary code execution or a denial of service.

Analysis

AI-generated

Technical impact

A flaw in GIMP's file-fits plugin allows an attacker to craft a FITS image with very large width and height values. The plugin uses 32‑bit signed integers to compute the allocation size; when the product of width and height exceeds 2^31 it overflows, allocating a buffer that is too small. A subsequent full row of pixels is written into this undersized buffer by cfitsio, resulting in a heap‑based buffer overflow that can corrupt memory and may lead to arbitrary code execution or a denial of service.

Affected Systems

The vulnerability affects GIMP installations across GNOME and Red Hat Enterprise Linux releases 6 through 9. Any system running GIMP, whether from the GNOME package or the RHEL distribution, is susceptible when the file‑fits plugin is enabled. No specific product or component version numbers beyond the operating system family are available.

Risk and Exploitability

With a CVSS score of 7.8 the vulnerability is classified as high severity; EPSS score is <1% and it is not listed in the CISA KEV catalog. The likely attack vector requires that a user run GIMP and open a malicious FITS image; remote exploitation is not supported by the information provided. Consequently, the risk is significant for systems where the FITS plugin is enabled and files from untrusted sources can be opened.

Remediation

Vendor Workaround

To mitigate this vulnerability, do not open FITS files from untrusted sources with GIMP.

OpenCVE Recommended Actions

  • Check the GIMP or GNOME website for available patches addressing the file-fits plugin integer overflow issue.
  • If no patch is available, uninstall or disable the FITS plugin to eliminate the vulnerable code path.
  • Do not open FITS files from untrusted or unknown sources.

Generated by OpenCVE AI on August 3, 2026 at 16:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DSA Debian DSA DSA-6470-1 gimp security update
History
Type Values Removed Values Added
First Time appeared Redhat rhel Els
CPEs cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7		 cpe:/o:redhat:rhel_els:6
cpe:/o:redhat:rhel_els:7
Vendors & Products Redhat rhel Els
Type Values Removed Values Added
CPEs cpe:/a:redhat:rhel_e4s:9.2::appstream
References
Type Values Removed Values Added
First Time appeared Redhat rhel E4s
CPEs cpe:/a:redhat:rhel_e4s:9.4::appstream
Vendors & Products Redhat rhel E4s
References
Type Values Removed Values Added
First Time appeared Redhat rhel Eus
CPEs cpe:/a:redhat:rhel_eus:9.6::appstream
Vendors & Products Redhat rhel Eus
References
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:8 cpe:/a:redhat:enterprise_linux:8::appstream
References
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:9 cpe:/a:redhat:enterprise_linux:9::appstream
References
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Gimp
Gimp gimp
Vendors & Products Gimp
Gimp gimp
Type Values Removed Values Added
Description A flaw was found in the file-fits plugin in GIMP. When processing a FITS image file, the plugin calculates memory allocation sizes using signed 32-bit integers for width and height. If a crafted file sets both values to large values, their product exceeds 2^31 and overflows, resulting in an undersized heap-based buffer allocation. This integer overflow issue results in a heap-based buffer overflow when cfitsio subsequently writes a full row of pixels in the buffer, causing memory corruption, potentially leading to arbitrary code execution or a denial of service.
Title Gimp: integer overflow in file-fits plugin causes a heap-based buffer overflow on crafted fits images
First Time appeared Redhat
Redhat enterprise Linux
Weaknesses CWE-190
CPEs cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}
Earlier changes (4)
Weaknesses
  • CWE-190

    Integer Overflow or Wraparound

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Nov 4, 2026, 11:01 PM
Reserved
Jul 27, 2026, 5:24 PM

View source JSON

Updated
Jul 29, 2026, 6:16 PM

JSON

Status
Modified
Published
Jul 27, 2026, 7:17 PM
Modified
Nov 4, 2026, 11:17 PM

View source JSON

No data.

Updated
Aug 3, 2026, 5:00 PM

JSON