CVE-2026-58380: Gimp: gimp: stack buffer overflow in pnmscanner_gettoken()
A flaw was found in GIMP's PNM file format parser. When parsing a specially crafted PNM file, the pnmscannergettoken() function writes a null terminator one byte past the end of a stack-allocated buffer due to an off-by-one error in the loop boundary check. This could lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.
Other sources
An off-by-one stack buffer overflow exists in GIMP's PNM file format parser. In pnmscannergettoken() in file-pnm.c, the loop condition ctr < bufsize allows ctr to reach bufsize (512), then buf[ctr] = '\0' writes one byte past the 512-byte stack buffer. The function is called from pnmloadascii() with a stack-allocated buf[BUFLEN] where BUFLEN = 512, with no extra room for the null terminator.
- Function: pnmscannergettoken() - File: plug-ins/common/file-pnm.c:2103-2122 - Fix: https://gitlab.gnome.org/GNOME/gimp/-/commit/83699817 - Upstream issue: https://gitlab.gnome.org/GNOME/gimp/-/issues/16206 - Acknowledgment: bb1abu
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-58380?
The severity of CVE-2026-58380 is rated as high, with a score of 7.8.
What does CVE-2026-58380 affect?
CVE-2026-58380 affects GIMP's PNM file format parser, specifically impacting systems running Red Hat Enterprise Linux.
How do I fix CVE-2026-58380?
To fix CVE-2026-58380, ensure you update to the latest patched version of GIMP that addresses this buffer overflow vulnerability.
What kind of vulnerability is CVE-2026-58380?
CVE-2026-58380 is a buffer overflow vulnerability that can lead to memory corruption.
Is my system at risk from CVE-2026-58380?
If you are using GIMP on Red Hat Enterprise Linux and have not applied the necessary patches, your system may be at risk from CVE-2026-58380.