CVE-2026-6694: Gimp: gimp file-png plugin: denial of service via oversized apng trns chunk
A flaw was found in GIMP's file-png plugin. A remote attacker can exploit this by crafting a malicious Animated Portable Network Graphics (APNG) image containing an oversized tRNS chunk. This can lead to a stack-based buffer overflow (CWE-121), causing the file-png plugin to crash and resulting in a Denial of Service (DoS) for the user.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/gimpto a version that resolves this vulnerability.Fixed in 3.2.4-1 - Upgrade
Upgrade
debian/gimpto a version that resolves this vulnerability.Fixed in 2.10.34-1+deb12u10Fixed in 3.0.4-3+deb13u10Fixed in 3.0.4-3+deb13u11Fixed in 3.2.6-1Fixed in 3.2.8-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6694?
CVE-2026-6694 has a medium severity rating of 5.5.
How do I fix CVE-2026-6694?
To fix CVE-2026-6694, update the GIMP file-png plugin to the latest version provided by the maintainers.
What type of vulnerability is CVE-2026-6694?
CVE-2026-6694 is a buffer overflow vulnerability that can cause denial of service.
Who can exploit CVE-2026-6694?
CVE-2026-6694 can be exploited by remote attackers through crafted APNG images.
What is the impact of CVE-2026-6694?
The impact of CVE-2026-6694 is a crash of the file-png plugin, leading to denial of service.