CVE-2026-66757 Details
Description
A flaw was found in the file-sgi plugin in GIMP. When processing an RLE-compressed SGI image, the plugin allocates memory for a row table. The image header dimensions (ysize and zsize) are read as 16-bit unsigned integers. If a crafted file sets both dimensions to their maximum value (65535), the multiplication ysize * zsize overflows the standard 32-bit int boundary before being passed to calloc. This integer overflow issue results in undefined behavior, aborting the plugin and causing a denial of service.
An integer overflow vulnerability has been identified in the file-sgi plugin of GIMP, specifically in version 3.2.4. When the plugin processes RLE-compressed SGI images, it reads the image header dimensions (ysize and zsize) as 16-bit unsigned integers. If a crafted file sets these dimensions to their maximum value, the resulting multiplication overflows the standard 32-bit integer limit before being passed to calloc. This overflow causes undefined behavior, crashing the plugin and creating a denial-of-service condition.
Users are advised not to open SGI files from untrusted sources with GIMP. For those using Red Hat Enterprise Linux, GIMP versions 2.8 and later are affected, but fixes are still pending. GIMP 3.2.4 users should update to the latest version where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gitlab.gnome.org/GNOME/gimp/-/work_items/16494 | CISA-ADP | ExploitIssue TrackingVendor Advisory |
| https://access.redhat.com/security/cve/CVE-2026-66757 | [email protected] | Vendor Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2507465 | [email protected] | Issue TrackingVendor Advisory |
| https://gitlab.gnome.org/GNOME/gimp/-/work_items/16494 | [email protected] | ExploitIssue TrackingVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-190 | Integer Overflow or Wraparound | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| gimp gimp | 3.2.6 |
CPE
Remediation
| |
| redhat enterprise linux | 7.0 8.0 9.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 10, 2026 | Initial Analysis | [email protected] |
| Jul 31, 2026 | CVE Modified | [email protected] |
| Jul 27, 2026 | CVE Modified | CISA-ADP |
| Jul 27, 2026 | New CVE Received | [email protected] |