GIMP ICNS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of ICNS files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27684.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade pygobject2-docUpgrade python2-cairoUpgrade pygtk2-develUpgrade pygtk2Upgrade pygobject2-develUpgrade gimp-devel-toolsUpgrade pygobject2-codegenUpgrade pygobject2Upgrade gimp-develUpgrade python2-cairo-develUpgrade gimpUpgrade pygtk2-docUpgrade pygtk2-codegenUpgrade gimp-libs | Dec 2, 2025 | Nov 24, 2025 |
| Debian | — | Upgrade gimp | Jul 23, 2026 | Jul 23, 2026 |
| Oracle_linux | — | Upgrade gimpUpgrade python2-cairo-develUpgrade pygtk2-develUpgrade pygtk2-docUpgrade pygobject2Upgrade pygtk2-codegenUpgrade gimp-develUpgrade pygtk2Upgrade pygobject2-codegenUpgrade pygobject2-develUpgrade gimp-devel-toolsUpgrade python2-cairoUpgrade gimp-libsUpgrade pygobject2-doc | Nov 28, 2025 | Oct 29, 2025 |
| Redhat_linux | — | Upgrade pygobject2-docUpgrade pygobject2Upgrade gimp-devel-toolsUpgrade python2-pycairo-debugsourceUpgrade pygobject2-develUpgrade python2-cairo-develUpgrade pygtk2-codegenUpgrade gimp-libsUpgrade pygtk2-debugsourceUpgrade pygobject2-codegenUpgrade gimp-devel-tools-debuginfoUpgrade gimp-develUpgrade pygobject2-debugsourceUpgrade gimpUpgrade pygtk2Upgrade python2-cairoUpgrade pygobject2-debuginfoUpgrade pygtk2-develNo solution existsUpgrade gimp-debugsourceUpgrade gimp-libs-debuginfoUpgrade gimp-debuginfoUpgrade pygtk2-debuginfoUpgrade python2-cairo-debuginfoUpgrade pygtk2-doc | Nov 25, 2025 | Oct 29, 2025 |
| Rocky_linux | — | Upgrade pygobject2-develUpgrade python2-cairo-debuginfoUpgrade python2-cairo-develUpgrade pygobject2-debugsourceUpgrade gimp-debuginfoUpgrade gimp-devel-toolsUpgrade gimp-develUpgrade pygtk2-debugsourceUpgrade pygobject2-debuginfoUpgrade pygtk2-debuginfoUpgrade pygtk2-codegenUpgrade pygtk2Upgrade pygobject2-docUpgrade gimp-libsUpgrade pygobject2-codegenUpgrade pygobject2Upgrade gimp-libs-debuginfoUpgrade gimp-devel-tools-debuginfoUpgrade gimp-debugsourceUpgrade python2-cairoUpgrade pygtk2-develUpgrade python2-pycairo-debugsourceUpgrade gimp | Feb 5, 2026 | Dec 2, 2025 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub