CVE-2026-58380
Full vulnerability record from the local CVENow database.
Description
A flaw was found in GIMP's PNM file format parser. When parsing a specially crafted PNM file, the pnmscanner_gettoken() function writes a null terminator one byte past the end of a stack-allocated buffer due to an off-by-one error in the loop boundary check. This could lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.
Severity
HIGH
CVSS score
7.8
(v3.1)
Vulnerability status
Undergoing Analysis
Source identifier
Published
2026-07-06 15:16:40.020000
Last modified
2026-11-02 10:17:11.940000
View original CVE JSON
{
"id": "CVE-2026-58380",
"sourceIdentifier": "[email protected]",
"published": "2026-07-06T15:16:40.020",
"lastModified": "2026-11-02T10:17:11.940",
"vulnStatus": "Undergoing Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in GIMP's PNM file format parser. When parsing a specially crafted PNM file, the pnmscanner_gettoken() function writes a null terminator one byte past the end of a stack-allocated buffer due to an off-by-one error in the loop boundary check. This could lead to memory corruption, potentially resulting in denial of service or arbitrary code execution."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gimp:2.8",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::appstream"
],
"versions": [
{
"version": "8100020260824165450.4c9c024f",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gimp",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream"
],
"versions": [
{
"version": "2:3.0.4-4.el9_8.7",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gimp",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2::appstream"
],
"versions": [
{
"version": "2:2.99.8-4.el9_2.7",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gimp",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.4::appstream"
],
"versions": [
{
"version": "2:2.99.8-4.el9_4.19",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gimp",
"cpes": [
"cpe:/a:redhat:rhel_eus:9.6::appstream"
],
"versions": [
{
"version": "2:2.99.8-4.el9_6.20",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
"defaultStatus": "unknown",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gimp",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 7",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gimp",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.3,
"impactScore": 5.9
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-07-06T15:41:04.583701Z",
"id": "CVE-2026-58380",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-193"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:gimp:gimp:3.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6F076B19-3582-4EC8-9625-D2E716652890"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "142AD0DD-4CF3-4D74-9442-459CE3347E3A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F4CFF558-3C47-480D-A2F0-BABF26042943"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7F6FB57C-2BC7-487C-96DD-132683AEB35D"
}
]
}
]
}
],
"references": [
{
"url": "https://access.redhat.com/errata/RHSA-2026:40751",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:62507",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:73768",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:80509",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:93589",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-58380",
"source": "[email protected]",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496135",
"source": "[email protected]",
"tags": [
"Issue Tracking",
"Third Party Advisory"
]
},
{
"url": "https://gitlab.gnome.org/GNOME/gimp/-/commit/83699817",
"source": "[email protected]",
"tags": [
"Broken Link"
]
},
{
"url": "https://gitlab.gnome.org/GNOME/gimp/-/issues/16206",
"source": "[email protected]",
"tags": [
"Exploit",
"Issue Tracking",
"Vendor Advisory"
]
}
]
}