CVE-2026-66758 Details

A heap-based buffer overflow vulnerability has been identified in the GIMP file-fits plugin, affecting versions 3.0.8, 3.2.4, and the master HEAD. The issue arises when the plugin processes FITS image files. It uses signed 32-bit integers to calculate memory allocation sizes based on the image's width and height. If a crafted FITS file sets these dimensions to large values, their product can exceed the maximum value for a signed integer, leading to an overflow. This results in an undersized buffer allocation on the heap. The vulnerability is exploited when the cfitsio library writes pixel data into this improperly sized buffer, causing memory corruption. This exploitation could potentially allow for arbitrary code execution or cause a denial-of-service condition.

Users are advised not to open FITS files from untrusted sources with GIMP. Red Hat has released a patch for this vulnerability in GIMP versions 2.8 and 2.10.