JLSEC-2026-1186 FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability...

FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple I...

ALSA-2026:50817 Important: gimp security update

The GIMP GNU Image Manipulation Program is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo. Security Fixes: gimp: GIMP APNG...

CVE-2026-42169

A heap-buffer-overflow vulnerability exists in the APNG Animated PNG file loader of GIMP. This flaw occurs when the fcTL width exceeds the IHDR width, leading to pixel data being written past the end of a heap allocation. Additionally, a heap-based buffer overflow exists in the DDS plug-in due to...

CVE-2026-42169

CVE-2026-42169 affects GIMP and its DDS plug-in. The APNG loader has a heap-buffer-overflow when fcTL width exceeds IHDR width, causing writes past heap bounds. A second heap-based overflow in the DDS plug-in arises from a BPP mismatch in load_layer(). Both issues are triggered by opening a speci...

CVE-2026-6694

A flaw was found in GIMP's file-png plugin. A remote attacker can exploit this by crafting a malicious Animated Portable Network Graphics APNG image containing an oversized tRNS chunk. This can lead to a stack-based buffer overflow CWE-121, causing the file-png plugin to crash and resulting in a...

UBUNTU-CVE-2026-6694

A flaw was found in GIMP's file-png plugin. A remote attacker can exploit this by crafting a malicious Animated Portable Network Graphics APNG image containing an oversized tRNS chunk. This can lead to a stack-based buffer overflow CWE-121, causing the file-png plugin to crash and resulting in a...

CVE-2026-6694 Gimp: gimp file-png plugin: denial of service via oversized apng trns chunk

A flaw was found in GIMP's file-png plugin. A remote attacker can exploit this by crafting a malicious Animated Portable Network Graphics APNG image containing an oversized tRNS chunk. This can lead to a stack-based buffer overflow CWE-121, causing the file-png plugin to crash and resulting in a...

CVE-2026-6694

CVE-2026-6694 affects GIMP’s file-png plugin. A crafted APNG with an oversized tRNS chunk may trigger a stack-based buffer overflow (CWE-121), causing the plugin to crash and resulting in a Denial of Service. The available documents specify the vulnerability and impact but do not provide remediat...

CVE-2026-6694

A flaw was found in GIMP's file-png plugin. A remote attacker can exploit this by crafting a malicious Animated Portable Network Graphics APNG image containing an oversized tRNS chunk. This can lead to a stack-based buffer overflow CWE-121, causing the file-png plugin to crash and resulting in a...

EUVD-2026-52150

A flaw was found in GIMP's file-png plugin. A remote attacker can exploit this by crafting a malicious Animated Portable Network Graphics APNG image containing an oversized tRNS chunk. This can lead to a stack-based buffer overflow CWE-121, causing the file-png plugin to crash and resulting in a...

Linux Distros Unpatched Vulnerability : CVE-2026-6694

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in GIMP's file-png plugin. A remote attacker can exploit this by crafting a malicious Animated Portable Network Graphics APNG image containing ...

SUSE CVE-2026-66040

FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple I...

CVE-2026-10819

Mattermost versions 11.6.x = 11.6.5, 10.11.x = 10.11.20, 11.8.x = 11.8.1, 11.7.x = 11.7.4 fail to limit the number of frames and enforce the file size cap on animated GIF uploads, which allows an authenticated attacker to cause a denial of service via a crafted animated GIF uploaded as a custom...

CVE-2026-10819

Mattermost versions 11.6.x = 11.6.5, 10.11.x = 10.11.20, 11.8.x = 11.8.1, 11.7.x = 11.7.4 fail to limit the number of frames and enforce the file size cap on animated GIF uploads, which allows an authenticated attacker to cause a denial of service via a crafted animated GIF uploaded as a custom...

EUVD-2026-49254

Mattermost versions 11.6.x = 11.6.5, 10.11.x = 10.11.20, 11.8.x = 11.8.1, 11.7.x = 11.7.4 fail to limit the number of frames and enforce the file size cap on animated GIF uploads, which allows an authenticated attacker to cause a denial of service via a crafted animated GIF uploaded as a custom...

CVE-2026-10819 Mattermost Server Denial of Service via Animated GIF Emoji Upload

Mattermost versions 11.6.x = 11.6.5, 10.11.x = 10.11.20, 11.8.x = 11.8.1, 11.7.x = 11.7.4 fail to limit the number of frames and enforce the file size cap on animated GIF uploads, which allows an authenticated attacker to cause a denial of service via a crafted animated GIF uploaded as a custom...

CVE-2026-10819 Mattermost Server Denial of Service via Animated GIF Emoji Upload

Mattermost versions 11.6.x = 11.6.5, 10.11.x = 10.11.20, 11.8.x = 11.8.1, 11.7.x = 11.7.4 fail to limit the number of frames and enforce the file size cap on animated GIF uploads, which allows an authenticated attacker to cause a denial of service via a crafted animated GIF uploaded as a custom...

CVE-2026-10819

The CVE CVE-2026-10819 affects Mattermost server versions 11.6.x <= 11.6.5, 10.11.x <= 10.11.20, 11.8.x <= 11.8.1, and 11.7.x

Malicious Package

Overview animated-css-kit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-66040 FFmpeg Heap Out-of-Bounds Write via PNG/APNG eXIf Encoder

FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple I...