CVE-2026-78475

Katalog CVE

CVSS 6.1 · Medium EPSS 0,26%

Kerentanan Out-of-bounds Read pada gimp, redhat enterprise linux. Skor CVSS 3.1 6.1 (Medium) menurut redhat.com.

Deskripsi (NVD)

A flaw was found in the file-pix (ESM) plugin in GIMP. When processing a specially crafted PIX image file, the plugin allocates a Variable-Length Array (VLA) on the stack without proper bounds checking, causing an unbounded stack allocation followed by a 21-byte stack over-read. This can result in a denial of service due to stack exhaustion and a limited information disclosure of stack memory contents into an intermediate file.

Rincian

Terbit di NVD

24 Agustus 2026

Terakhir diubah

12 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

6.1 (Medium), sumber redhat.com
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-125: Out-of-bounds Read

EPSS (30 hari)

0,26% peluang dieksploitasi; lebih tinggi dari 17,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2026-78475 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2522072 issue tracking · advisory vendor
• https://gitlab.gnome.org/GNOME/gimp/-/work_items/16580 issue tracking · advisory vendor · mitigasi