imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution

Summary The ICO loader allocates datasize + BMPFILEHEADERLEN bytes after reading a 32-bit attacker-controlled datasize. For datasize UINT32MAX - BMPFILEHEADERLEN, the addition wraps before allocation. imgproxy then writes the ICO prefix and reads up to the original declared size starting 14 bytes...

imgproxy has out-of-bounds heap read/write in ICO loader BMP header reconstruction that allows unauthenticated remote worker crash

Summary Out-of-bounds heap write in imgproxy's ICO loader vips/icoload.c: when the ICO entry's image data buffer is small, the loader's BMP-header-reconstruction writes land past the allocation, corrupting the size field of the following heap chunk. The worker then aborts deterministically glibc...

imgproxy has unbounded memory allocation in ICO loader that allows unauthenticated memory-exhaustion DoS via crafted data_size field

Summary Unbounded and unvalidated memory allocation in imgproxy's ICO loader vips/icoload.c. An attacker-controlled datasize field u32 from the ICO directory entry is passed directly to VIPSMALLOC without any bounds check, so a single crafted 23-byte ICO file makes an imgproxy worker attempt a 4G...

SUSE SLED15: gimp / gimp-devel / gimp-lang / gimp-plugin-aa / libgimp-2_0-0 / etc (SUSE-SU-2026:4895-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4895-1 advisory. - CVE-2026-82328: undersized palette memory allocations in the ICO loader can cause heap out-of-bounds reads...

Security update for gimp

This update for gimp fixes the following issues: CVE-2026-82328: undersized palette memory allocations in the ICO loader can cause heap out-of-bounds reads bsc1277618. CVE-2026-82343: improper channel-count handling in the PSD loader can cause heap and stack out-of-bounds reads bsc1277622...

SUSE-SU-2026:4895-1 Security update for gimp

This update for gimp fixes the following issues: - CVE-2026-82328: undersized palette memory allocations in the ICO loader can cause heap out-of-bounds reads bsc1277618. - CVE-2026-82343: improper channel-count handling in the PSD loader can cause heap and stack out-of-bounds reads bsc1277622. -...

AlmaLinux 8 : gimp:2.8 (ALSA-2026:84744)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:84744 advisory. gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset file CVE-2026-90947 gimp: gimp: heap-based buffer overflow in ICO loader vi...

gimp: gimp: heap-based buffer overflow in ICO loader via integer overflow in embedded PNG dimensions

A flaw was found in GIMP's ICO file loader. When processing an ICO file containing an embedded PNG image, an integer overflow can occur during the calculation of the required buffer size. This leads to an undersized buffer being allocated, causing a heap-based buffer overflow when the decoded pix...

AlmaLinux 9 : gimp (ALSA-2026:75575)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:75575 advisory. gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset file CVE-2026-90947 gimp: gimp: heap-based buffer overflow in ICO loader vi...

gimp: gimp: heap-based buffer overflow in ICO loader via integer overflow in embedded PNG dimensions

A flaw was found in GIMP's ICO file loader. When processing an ICO file containing an embedded PNG image, an integer overflow can occur during the calculation of the required buffer size. This leads to an undersized buffer being allocated, causing a heap-based buffer overflow when the decoded pix...

CVE-2026-90948

A flaw was found in GIMP's ICO file loader. When processing an ICO file containing an embedded PNG image, an integer overflow can occur during the calculation of the required buffer size. This leads to an undersized buffer being allocated, causing a heap-based buffer overflow when the decoded pix...

CVE-2026-90948

GIMP's ICO file loader is vulnerable to a heap-based buffer overflow triggered by an integer overflow when calculating the buffer size for an embedded PNG image within an ICO file. The undersized allocation causes decoded pixel data to overflow the buffer, potentially enabling arbitrary code exec...

CVE-2026-90948 Gimp: gimp: heap-based buffer overflow in ico loader via integer overflow in embedded png dimensions

A flaw was found in GIMP's ICO file loader. When processing an ICO file containing an embedded PNG image, an integer overflow can occur during the calculation of the required buffer size. This leads to an undersized buffer being allocated, causing a heap-based buffer overflow when the decoded pix...

EUVD-2026-77471

A flaw was found in GIMP's ICO file loader. When processing an ICO file containing an embedded PNG image, an integer overflow can occur during the calculation of the required buffer size. This leads to an undersized buffer being allocated, causing a heap-based buffer overflow when the decoded pix...

CVE-2026-90948 Gimp: gimp: heap-based buffer overflow in ico loader via integer overflow in embedded png dimensions

A flaw was found in GIMP's ICO file loader. When processing an ICO file containing an embedded PNG image, an integer overflow can occur during the calculation of the required buffer size. This leads to an undersized buffer being allocated, causing a heap-based buffer overflow when the decoded pix...

PT-2026-91215

Name of the Vulnerable Software and Affected Versions GIMP affected versions not specified Red Hat Enterprise Linux affected versions not specified Description A flaw exists in the ICO file loader. When processing an ICO file that contains an embedded PNG image, an integer overflow can occur duri...

CLSA-2026-1788429305 gimp: Fix of CVE-2026-82328

CVE-2026-82328: fix heap out-of-bounds read in the ICO loader by bounding the usedclrs palette-size field to the maximum colors for the image bit depth and allocating the palette using that bound instead of the untrusted header value...

CLSA-2026-1788427757 gimp: Fix of CVE-2026-82328

CVE-2026-82328: fix heap out-of-bounds read in the ICO loader by bounding the usedclrs palette-size field to the maximum colors for the image bit depth and allocating the palette using that bound instead of the untrusted header value...

CVE-2026-82328

GIMP's file-ico plugin is vulnerable to a heap out-of-bounds read triggered when processing a specially crafted ICO image file. The root cause is improper validation of the used_clrs (palette count) parameter , which leads to incorrect memory bounds checking. The impact is an application crash (d...

CVE-2026-82328 Gimp: heap out-of-bounds read in ico loader via unvalidated used_clrs palette count

A flaw was found in the file-ico plugin in GIMP. When processing a specially crafted ICO image file, the plugin does not properly validate the usedclrs palette count parameter. This incorrect validation leads to improper memory bounds checking, resulting in a heap out-of-bounds read. This issue c...