Yüksek CVSS 7.1 PoC var
CVE-2026-66759: Gimp: sınır dışı okuma
Açıklama (NVD)
A flaw was found in the file-icns plugin in GIMP. When applying a decompressed mask during ICNS image processing, the plugin reads from the mask data buffer without verifying if the cursor exceeds the allocated resource size. If a crafted file contains a truncated mask resource, the icns_decompress function continues reading past the bounds of the buffer. This out-of-bounds read vulnerability results in information disclosure of heap contents, where memory contents are leaked as alpha channel pixel values, or a crash leading to a denial of service if unmapped memory is accessed.
Özet bilgiler
- Ürün
- Gimp Gimp
- CVSS v3.1
- 7.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - EPSS
- %0,31 (yüzdelik 23)
- CWE
- CWE-125
- Yama
- Yok / bilinmiyor
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| gimp-gimp | 3.0.8 | 3.0.8 | — |
| gimp-gimp | 3.2.4 | 3.2.4 | — |
| redhat-enterprise-linux | 6.0 | 6.0 | — |
| redhat-enterprise-linux | 7.0 | 7.0 | — |
| redhat-enterprise-linux | 8.0 | 8.0 | — |
| redhat-enterprise-linux | 9.0 | 9.0 | — |