CVE-2026-18307: GIMP TIF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
GIMP TIF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of TIF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29404.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Since exploitation requires a victim to open a malicious TIF file or visit a malicious page, restrict users from opening untrusted TIF files and prevent access to untrusted/malicious pages where applicable (e.g., via browser or network filtering).
- Compensating control
Given the heap-based buffer overflow in GIMP's TIF parsing that can lead to remote code execution, isolate or restrict GIMP execution (e.g., run in a sandbox/container or limit permissions) to reduce impact if malicious TIF content is processed.
Event History
Frequently Asked Questions
What does an attacker need to do to trigger the issue?
The target must visit a malicious page or open a malicious file. Exploitation involves a crafted TIF file that reaches GIMP's TIF parser.
What privileges does successful exploitation provide?
An attacker can execute arbitrary code in the context of the current GIMP process. The provided data does not indicate that elevated operating-system privileges are obtained automatically.
Is this limited to a specific GIMP feature or file type?
The flaw is in parsing TIF files, where insufficient validation of user-supplied length data can cause a heap-based buffer overflow.