CVE-2026-58380: GIMP PNM Parser Stack Buffer Overflow – Off-by-One Memory Corruption

Technical summary

CVE-2026-58380 is an off-by-one error in GIMP's pnmscanner_gettoken() function within the PNM file format parser. The vulnerability occurs when parsing a specially crafted PNM file: the loop boundary check fails to account for the null terminator, causing the function to write one byte past the allocated stack buffer. This stack-based buffer overflow (CWE-193) corrupts adjacent memory, potentially enabling control-flow hijacking or denial of service depending on memory layout and exploitation conditions.

Business impact

For organizations deploying GIMP in shared environments, image processing workflows, or user-facing graphics editing services, this vulnerability poses a containment risk. Compromise of an editing workstation could escalate to lateral movement if GIMP runs with elevated privileges or in a multi-user environment. The requirement for local access and user action (opening a file) limits exposure to targeted attacks—for example, a crafted PNM file distributed via email or shared storage. However, in security-sensitive image processing pipelines or collaborative design teams, an attacker could deliver a malicious file to achieve code execution on a trusted system.

Affected systems

GIMP itself is directly affected. The vulnerability also impacts Red Hat Enterprise Linux systems that bundle GIMP or include it as part of the default install set, depending on the specific RHEL version and variant. Organizations should verify which RHEL versions in their estate include vulnerable GIMP packages and cross-reference against their patching schedules.

Exploitability

Exploitation requires local system access and user interaction: the victim must open a crafted PNM file in GIMP. The attack surface is primarily limited to scenarios where attackers can reliably deliver a malicious image file—such as email attachments, web uploads parsed by GIMP, or file-sharing platforms. The vulnerability is not remotely exploitable without a separate mechanism to trigger file opening. No public exploit code is currently documented in the known exploited vulnerabilities (KEV) list, though the technical nature of the flaw and its memory-corruption severity make it a plausible target for weaponization.

Remediation

Patch GIMP to a version that corrects the off-by-one error in the pnmscanner_gettoken() function's loop boundary check. Red Hat will issue patched versions of GIMP through its standard security update channels; track RHEL security advisories for exact version numbers. In the interim, restrict file-opening privileges for GIMP in sensitive environments, disable PNM format support if unused, or isolate GIMP workstations from untrusted file sources. User education about not opening image files from untrusted sources is a complementary control.

Patch guidance

Monitor Red Hat's security errata portal for GIMP updates associated with CVE-2026-58380. Apply patches to GIMP and affected RHEL packages as soon as testing permits. If your organization uses GIMP from upstream sources (gimp.org), watch for releases that address this off-by-one error in the PNM parser. Coordinate patching with your image processing workflows to minimize disruption; consider staging patches in non-production environments first to validate compatibility with custom plugins or scripts that may interact with PNM parsing.

Detection guidance

Monitor for failed GIMP process execution or crashes triggered by PNM file handling, particularly if unusual files arrive via email or file-sharing systems. Endpoint detection and response (EDR) tools should flag stack-based buffer overflows or abnormal memory access patterns originating from GIMP. Log file-open events in GIMP where feasible and correlate them with file sources. Additionally, watch for post-compromise indicators: unexpected child processes spawned from GIMP, lateral movement attempts originating from a GIMP workstation, or changes to files in image processing directories.

Why prioritize this

This vulnerability merits high priority due to its CVSS 3.1 score of 7.3 (HIGH severity), which reflects high impact (confidentiality, integrity, and availability compromised) and a relatively low barrier to exploitation (local access, low attack complexity). Although it does not yet appear on the KEV list, the combination of memory-corruption severity and direct code-execution potential makes it attractive for targeted attack. Organizations with frequent PNM file handling, graphics workstations, or image-intensive services should prioritize patching within days rather than weeks.

Risk score, explained

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H yields a score of 7.3 (HIGH). Attack Vector is Local (AV:L) because exploitation requires local system access. Attack Complexity is Low (AC:L), reflecting the straightforward nature of the off-by-one error and lack of complex mitigations. Privileges Required (PR:L) indicates the user must have login capability. User Interaction (UI:R) is required: the user must open a malicious PNM file. The vulnerability impacts only the compromised system (S:U), with all three impact categories (C, I, A) rated High—memory corruption can enable data exfiltration, code modification, and denial of service.

Frequently asked questions