CVE-2026-80101
MediumCVSS 4.4Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The file-xwd plugin in GIMP has a flaw due to incorrect validation of image width and bytes-per-line parameters when processing specially crafted XWD files. This leads to a heap out-of-bounds read.
Risk Assessment
Processing a malicious XWD file can cause an application crash (denial of service) or limited disclosure of heap memory contents into the produced image, potentially exposing sensitive data.
Recommendation
Update GIMP to a version that fixes this vulnerability. Avoid opening untrusted XWD files until the update is applied.
Other vulnerabilities in GIMP
See all- CVE-2017-17789High
In GIMP 2.8.22, there is a heap-based buffer overflow in read_channel_data in plug-ins/common/file-psp.c.
- CVE-2017-17787High
In GIMP 2.8.22, there is a heap-based buffer over-read in the read_creator_block handler in plug-ins/common/file-psp.c.
- CVE-2017-17786High
In GIMP 2.8.22, there is a heap-based buffer over-read in ReadImage in plug-ins/common/file-tga.c, related to an unexpected bits-per-pixel value for an RGBA image.
- CVE-2017-17785High
In GIMP 2.8.22, there is a heap-based buffer overflow in the fli_read_brun function in plug-ins/file-fli/fli.c.
- CVE-2017-17784High
In GIMP 2.8.22, there is a heap-based buffer over-read in load_image in plug-ins/common/file-gbr.c, related to mishandling of UTF-8 data.
- CVE-2016-4994High
A use-after-free vulnerability in the xcf_load_image function in xcf-load.c in GIMP allows remote attackers to cause a denial of service (program crash) or possibly execute arbitrary code via a crafted XCF file.
- CVE-2026-119528High
A flaw was found in GIMP's PSD plug-in: the image resource header loader uses an incorrect destination size when copying a converted resource name into a fixed stack buffer. Opening a crafted PSD file can cause a stack-based buffer overflow, leading to a crash and potentially arbitrary code execution.
- CVE-2026-92183High
GIMP contains a stack-based buffer overflow in APNG file parsing due to lack of proper validation of user-supplied data length before copying it to a stack buffer. A remote attacker can achieve arbitrary code execution in the context of the current process if the target opens a malicious file or visits a malicious page.
- CVE-2026-112261High
A flaw was found in GIMP. Opening a crafted XCF that selects a path and then fails to load that path can cause a use-after-free in the main process, leading to a crash and potentially arbitrary code execution.
- CVE-2026-112258High
A flaw was found in GIMP. The XCF loader can leave a dangling pointer in the linked-channels list when a linked channel is later destroyed via a selection property. Opening a crafted XCF file can cause a use-after-free in the main GIMP process, leading to a crash and potentially arbitrary code execution.
Original NVD description (English source)
A flaw was found in the file-xwd plugin in GIMP. When processing a specially crafted XWD image file, the plugin validates the image width and bytes-per-line parameters independently rather than ensuring their combined values are consistent with the allocated buffer size. This incorrect validation leads to improper bounds checking, causing a heap out-of-bounds read. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of heap memory contents into the produced image.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS