Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 134

Export CSV
CVE-2026-18304

GIMP TIF File Parsing Integer Overflow Remote Code Execution Vulnerability

GIMP TIF File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29403.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Gimp
Products
Gimp
CVE-2026-18303

GIMP TIF File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

GIMP TIF File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29399.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Gimp
Products
Gimp
CVE-2026-18302

GIMP TIF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

GIMP TIF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29398.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Gimp
Products
Gimp
CVE-2026-18301

GIMP PSD File Parsing Integer Overflow Remote Code Execution Vulnerability

GIMP PSD File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PSD files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29395.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Gimp
Products
Gimp
CVE-2026-18300

GIMP HDR File Parsing Integer Overflow Remote Code Execution Vulnerability

GIMP HDR File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of HDR files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29289.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Gimp
Products
Gimp
CVE-2026-2049

GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of HDR files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28618.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Gimp
Products
Gimp
CVE-2009-0581

LittleCms memory leak

Memory leak in LittleCMS (aka lcms or liblcms) before 1.18beta2, as used in Firefox 3.1beta, OpenJDK, and GIMP, allows context-dependent attackers to cause a denial of service (memory consumption and application crash) via a crafted image file.

CVSS 2.0 · 4.3 Medium EPSS 2.5% KEV · Not listed
Vendors
Gimp Littlecms Mozilla and 2 more
Products
Gimp Little Cms Firefox and 2 more
CVE-2007-3126

Gimp: context-dependent attackers to cause a denial of service

Gimp before 2.8.22 allows context-dependent attackers to cause a denial of service (crash) via an ICO file with an InfoHeader containing a Height of zero, a similar issue to CVE-2007-2237.

CVSS 3.1 · 7.5 High EPSS 2.9% KEV · Not listed
Vendors
Gimp
Products
Gimp
CVE-2007-2356

Stack overflow in gimp's sunras plugin

Stack-based buffer overflow in the set_color_table function in sunras.c in the SUNRAS plugin in Gimp 2.2.14 allows user-assisted remote attackers to execute arbitrary code via a crafted RAS file.

CVSS 2.0 · 6.8 Medium EPSS 15.7% KEV · Not listed
Vendors
Gimp Redhat
Products
Gimp Enterprise Linux
CVE-2006-4519

GIMP multiple image loader integer overflows

Multiple integer overflows in the image loader plug-ins in GIMP before 2.2.16 allow user-assisted remote attackers to execute arbitrary code via crafted length values in (1) DICOM, (2) PNM, (3) PSD, (4) PSP, (5) Sun RAS, (6) XBM, and (7) XWD files.

CVSS 2.0 · 6.8 Medium EPSS 5.6% KEV · Not listed
Vendors
Gimp Redhat
Products
Gimp Enterprise Linux
CVE-2007-2949

Gimp PSD integer overflow

Integer overflow in the seek_to_and_unpack_pixeldata function in the psd.c plugin in Gimp 2.2.15 allows remote attackers to execute arbitrary code via a crafted PSD file that contains a large (1) width or (2) height value.

CVSS 2.0 · 6.8 Medium EPSS 7.2% KEV · Not listed
Vendors
Canonical Gimp Redhat
Products
Ubuntu Linux Gimp Enterprise Linux
CVE-2009-3909

Gimp: Integer overflow in the PSD image file plugin

Integer overflow in the read_channel_data function in plug-ins/file-psd/psd-load.c in GIMP 2.6.7 might allow remote attackers to execute arbitrary code via a crafted PSD file that triggers a heap-based buffer overflow.

CVSS 2.0 · 9.3 Critical EPSS 8.7% KEV · Not listed
Vendors
Gimp Redhat
Products
Gimp Enterprise Linux
CVE-2009-1570

Gimp: Integer overflow in the BMP image file plugin

Integer overflow in the ReadImage function in plug-ins/file-bmp/bmp-read.c in GIMP 2.6.7 might allow remote attackers to execute arbitrary code via a BMP file with crafted width and height values that trigger a heap-based buffer overflow.

CVSS 2.0 · 9.3 Critical EPSS 8.0% KEV · Not listed
Vendors
Gimp Redhat
Products
Gimp Enterprise Linux
CVE-2009-0733

LittleCms lack of upper-bounds check on sizes

Multiple stack-based buffer overflows in the ReadSetOfCurves function in LittleCMS (aka lcms or liblcms) before 1.18beta2, as used in Firefox 3.1beta, OpenJDK, and GIMP, allow context-dependent attackers to execute arbitrary code via a crafted image file associated with a large integer value for the (1) input or (2) output channel, related to the ReadLUT_A2B and ReadLUT_B2A functions.

CVSS 2.0 · 9.3 Critical EPSS 5.5% KEV · Not listed
Vendors
Gimp Littlecms Mozilla and 2 more
Products
Gimp Little Cms Firefox and 2 more
CVE-2009-0723

LittleCms integer overflow

Multiple integer overflows in LittleCMS (aka lcms or liblcms) before 1.18beta2, as used in Firefox 3.1beta, OpenJDK, and GIMP, allow context-dependent attackers to execute arbitrary code via a crafted image file that triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third party information.

CVSS 2.0 · 9.3 Critical EPSS 5.0% KEV · Not listed
Vendors
Gimp Littlecms Mozilla and 2 more
Products
Gimp Little Cms Firefox and 2 more
CVE-2026-2045

GIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

GIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XWD files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28265.

CVSS 3.1 · 7.3 High EPSS 5.3% KEV · Not listed
Vendors
Gimp
Products
Gimp
CVE-2026-2047

GIMP ICNS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

GIMP ICNS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of ICNS files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28530.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Gimp
Products
Gimp
CVE-2026-2048

GIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

GIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XWD files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28591.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Gimp
Products
Gimp
CVE-2026-0797

GIMP ICO File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

GIMP ICO File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of ICO files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28599.

CVSS 3.1 · 8.8 High EPSS 1.3% KEV · Not listed
Vendors
Gimp
Products
Gimp
CVE-2026-2044

GIMP PGM File Parsing Uninitialized Memory Remote Code Execution Vulnerability

GIMP PGM File Parsing Uninitialized Memory Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PGM files. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28158.

CVSS 3.1 · 8.8 High EPSS 1.1% KEV · Not listed
Vendors
Gimp
Products
Gimp