Source: gimp Version: 3.2.4-3 Severity: important Tags: security upstream Forwarded: https://gitlab.gnome.org/GNOME/gimp/-/work_items/16580 X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerability was published for gimp. CVE-2026-78475[0]: | A flaw was found in the file-pix (ESM) plugin in GIMP. When | processing a specially crafted PIX image file, the plugin allocates | a Variable-Length Array (VLA) on the stack without proper bounds | checking, causing an unbounded stack allocation followed by a | 21-byte stack over-read. This can result in a denial of service due | to stack exhaustion and a limited information disclosure of stack | memory contents into an intermediate file. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-78475 https://www.cve.org/CVERecord?id=CVE-2026-78475 [1] https://gitlab.gnome.org/GNOME/gimp/-/work_items/16580 [2] https://gitlab.gnome.org/GNOME/gimp/-/commit/27d83534e637cf160f913ac6d6388d5a5555e9d8 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
