VDB
CVE-2026-42169
CVE-2026-42169
PUBLISHED
CVSS 7.3 HIGH
Reported by redhat · Published August 4, 2026
A heap-buffer-overflow vulnerability exists in the APNG (Animated PNG) file loader of GIMP. This flaw occurs when the `fcTL` width exceeds the `IHDR` width, leading to pixel data being written past the end of a heap allocation. Additionally, a heap-based buffer overflow exists in the DDS plug-in due to a BPP mismatch in the `load_layer()` function. Both vulnerabilities can be triggered by opening a specially crafted image file, potentially leading to code execution.
Risk Scores
CVSS 3.1
7.3
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 9 | 2:3.0.4-4.el9_8.9 |
| Red Hat | Red Hat Enterprise Linux 6 | |
| Red Hat | Red Hat Enterprise Linux 7 | |
| Red Hat | Red Hat Enterprise Linux 8 | |
| Red Hat | Red Hat Enterprise Linux 7 | |
| Red Hat | Red Hat Enterprise Linux 9 | 2:3.0.4-4.el9_8.9 |
| Red Hat | Red Hat Enterprise Linux 8 | |
| Red Hat | Red Hat Enterprise Linux 6 |
Timeline
- Aug 4, 2026 EPSS Score
- Aug 4, 2026 Coalition ESS Score
- Aug 4, 2026 CVE Published
- Aug 4, 2026 Security Advisory
- Aug 6, 2026 CVE Updated
- Aug 7, 2026 EPSS Score
- Aug 7, 2026 Distribution Patch
- Aug 7, 2026 Security Advisory
References
- RHSA-2026:50817 vendor-advisoryx_refsource_REDHAT
- vdb-entryx_refsource_REDHAT
- RHBZ#2461725 issue-trackingx_refsource_REDHAT