CVE-2026-78475: Gimp

Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days.

A flaw was found in the file-pix (ESM) plugin in GIMP. When processing a specially crafted PIX image file, the plugin allocates a Variable-Length Array (VLA) on the stack without proper bounds checking, causing an unbounded stack allocation followed by a 21-byte stack over-read. This can result in a denial of service due to stack exhaustion and a limited information disclosure of stack memory contents into an intermediate file.

Affected products

• Gimp Gimp: from 3.0.0, up to and including 3.3.1
• Red Hat Enterprise Linux: version 9.0 only

Published 2026-08-24. Last modified 2026-09-01.