CVE-2026-78475

{
  "id": "CVE-2026-78475",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-24T18:17:34.807",
  "lastModified": "2026-11-06T01:17:52.610",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw was found in the file-pix (ESM) plugin in GIMP. When processing a specially crafted PIX image file, the plugin allocates a Variable-Length Array (VLA) on the stack without proper bounds checking, causing an unbounded stack allocation followed by a 21-byte stack over-read. This can result in a denial of service due to stack exhaustion and a limited information disclosure of stack memory contents into an intermediate file."
    },
    {
      "lang": "es",
      "value": "Se encontró una vulnerabilidad en el plugin file-pix (ESM) en GIMP. Al procesar un archivo de imagen PIX especialmente manipulado, el plugin asigna un array de longitud variable (VLA) en la pila sin una comprobación de límites adecuada, lo que provoca una asignación de pila ilimitada seguida de una lectura excesiva de la pila de 21 bytes. Esto puede resultar en una denegación de servicio debido al agotamiento de la pila y una revelación de información limitada del contenido de la memoria de la pila en un archivo intermedio."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "GNOME",
          "product": "GIMP",
          "defaultStatus": "unaffected",
          "collectionURL": "https://gitlab.gnome.org/GNOME/gimp",
          "packageName": "gimp",
          "versions": [
            {
              "version": "3.0.0",
              "lessThan": "*",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 6",
          "defaultStatus": "unaffected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "gimp",
          "cpes": [
            "cpe:/o:redhat:rhel_els:6"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 7",
          "defaultStatus": "unaffected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "gimp",
          "cpes": [
            "cpe:/o:redhat:rhel_els:7"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8",
          "defaultStatus": "unaffected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "gimp:2.8/gimp",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 9",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "gimp",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9"
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 4.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-24T19:57:37.522179Z",
          "id": "CVE-2026-78475",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:gimp:gimp:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "3.0.0",
              "versionEndIncluding": "3.3.1",
              "matchCriteriaId": "31A92901-1F5A-4EC4-8164-6EB2F3F6C246"
            }
          ]
        }
      ]
    },
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "7F6FB57C-2BC7-487C-96DD-132683AEB35D"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://access.redhat.com/security/cve/CVE-2026-78475",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522072",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://gitlab.gnome.org/GNOME/gimp/-/work_items/16580",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking",
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}