What’s Vulnerable › Vulnerabilities

CVE-2026-2272: Gimp: gimp: memory corruption due to integer overflow in ico file handling

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-03-26 · updated 2026-06-17
• Weakness: CWE-190

Description

A flaw was found in GIMP. An integer overflow vulnerability exists when processing ICO image files, specifically in the `ico_read_info` and `ico_read_icon` functions. This issue arises because a size calculation for image buffers can wrap around due to a 32-bit integer evaluation, allowing oversized image headers to bypass security checks. A remote attacker could exploit this by providing a specially crafted ICO file, leading to a buffer overflow and memory corruption, which may result in an application level denial of service.

Affected products

• GIMP: 3.0.6
• Red Hat Enterprise Linux: 6.0, 7.0, 8.0, 9.0

References

• https://access.redhat.com/security/cve/CVE-2026-2272
• https://bugzilla.redhat.com/show_bug.cgi?id=2438428
• https://gitlab.gnome.org/GNOME/gimp/-/issues/15617
• https://bugzilla.redhat.com/show_bug.cgi?id=2438428
• https://gitlab.gnome.org/GNOME/gimp/-/issues/15617

Get alerted when CVE-2026-2272 or the next vulnerability affects your stack