CVE-2026-6694: Gimp: gimp file-png plugin: denial of service via oversized apng trns chunk
Published Apr 20, 2026
·Updated
A flaw was found in GIMP's file-png plugin. A remote attacker can exploit this by crafting a malicious Animated Portable Network Graphics (APNG) image containing an oversized tRNS chunk. This can lead to a stack-based buffer overflow (CWE-121), causing the file-png plugin to crash and resulting in a Denial of Service (DoS) for the user.
Affected Software
1 affected component
GIMP file-png plugin
Event History
Apr 20, 2026
Data Sourced
via Red Hat·04:47 PM
DescriptionSeverityAffected Software
Aug 3, 2026
CVE Published
via MITRE·04:05 AM
Data Sourced
via MITRE·04:05 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·06:16 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-6694?
CVE-2026-6694 has a medium severity rating of 5.5.
2
How do I fix CVE-2026-6694?
To fix CVE-2026-6694, update the GIMP file-png plugin to the latest version provided by the maintainers.
3
What type of vulnerability is CVE-2026-6694?
CVE-2026-6694 is a buffer overflow vulnerability that can cause denial of service.
4
Who can exploit CVE-2026-6694?
CVE-2026-6694 can be exploited by remote attackers through crafted APNG images.
5
What is the impact of CVE-2026-6694?
The impact of CVE-2026-6694 is a crash of the file-png plugin, leading to denial of service.