CVE-2026-66759: gimp Out-of-bounds Read
Vulnerability summary
CVE-2026-66759 is a high (CVSS 7.1) Out-of-bounds Read vulnerability in gimp. EPSS estimates a 0.30% chance of exploitation in the next 30 days, higher than 21.9% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 3 · Related 2Timeline
- 27-07-2026PublishedVulnerability first disclosed.
- 24-08-2026Last modifiedVulnerability information updated.
Description
A flaw was found in the file-icns plugin in GIMP. When applying a decompressed mask during ICNS image processing, the plugin reads from the mask data buffer without verifying if the cursor exceeds the allocated resource size. If a crafted file contains a truncated mask resource, the icns_decompress function continues reading past the bounds of the buffer. This out-of-bounds read vulnerability results in information disclosure of heap contents, where memory contents are leaked as alpha channel pixel values, or a crash leading to a denial of service if unmapped memory is accessed.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
- NVDNIST7.1HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
EPSS trend
Probability
0.30%
Chance of exploitation in the next 30 days
Percentile
22%
Versus all other CVEs
30-day change
+0.05 pp
From 0.25% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (gitlab.gnome.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Debian1 product
- gimpAll versions (No fix recorded) | < 3.0.4-3+deb13u10 | < 3.2.6-1
Gimp1 product
- gimp3.0.8 | 3.2.4
Gnome1 product
- gimp≥ 2.99.14 (No fix recorded)
Redhat1 product
- enterprise_linuxEOL6.0 | 7.0 | 8.0 | 9.0
Ubuntu1 product
- gimpAll versions (No fix recorded)
5 vendors · 5 products
