CVE-2026-42169: Gimp: gimp apng loader heap-buffer-overflow when fctl width exceeds ihdr width (file-png.c)
A heap-buffer-overflow vulnerability exists in the APNG (Animated PNG) file loader of GIMP. This flaw occurs when the fcTL width exceeds the IHDR width, leading to pixel data being written past the end of a heap allocation. Additionally, a heap-based buffer overflow exists in the DDS plug-in due to a BPP mismatch in the loadlayer() function. Both vulnerabilities can be triggered by opening a specially crafted image file, potentially leading to code execution.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42169?
The severity of CVE-2026-42169 is high, with a score of 7.3.
How do I fix CVE-2026-42169?
To fix CVE-2026-42169, update GIMP to the latest version that addresses this vulnerability.
What type of vulnerability is CVE-2026-42169?
CVE-2026-42169 is classified as a heap-buffer-overflow vulnerability.
What can happen if I exploit CVE-2026-42169?
Exploiting CVE-2026-42169 can lead to arbitrary code execution due to memory corruption.
Which software is affected by CVE-2026-42169?
CVE-2026-42169 affects the GIMP software, specifically its APNG file loader.