VULNERABILITY INTELLIGENCE

CVE-2026-78475

CVSS score6.1 MEDIUM
EPSS probability0.26%
CISA KEVNot currently listed
Published2026-08-24
Last modified2026-10-12
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

Description

A flaw was found in the file-pix (ESM) plugin in GIMP. When processing a specially crafted PIX image file, the plugin allocates a Variable-Length Array (VLA) on the stack without proper bounds checking, causing an unbounded stack allocation followed by a 21-byte stack over-read. This can result in a denial of service due to stack exhaustion and a limited information disclosure of stack memory contents into an intermediate file.

Weakness classification

  • secalert@redhat.com: CWE-125

Primary references