CVE-2026-78475: Gimp: unbounded stack vla and 21-byte stack over-read in pix (esm) loader
A flaw was found in the file-pix (ESM) plugin in GIMP, affecting versions 3.0.0 and newer. When processing a specially crafted PIX image file, the plugin allocates a Variable-Length Array (VLA) on the stack without proper bounds checking, causing an unbounded stack allocation followed by a 21-byte stack over-read. This can result in a denial of service due to stack exhaustion and a limited information disclosure of stack memory contents into an intermediate file.
Other sources
A flaw was found in the file-pix (ESM) plugin in GIMP. When processing a specially crafted PIX image file, the plugin allocates a Variable-Length Array (VLA) on the stack without proper bounds checking, causing an unbounded stack allocation followed by a 21-byte stack over-read. This can result in a denial of service due to stack exhaustion and a limited information disclosure of stack memory contents into an intermediate file.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What must an attacker do to trigger this issue?
An attacker needs to persuade a user to open or process a specially crafted PIX image file with GIMP's file-pix (ESM) plugin. The attack is local and requires user interaction; no privileges are required.
What is the practical impact if exploitation succeeds?
Processing the malicious file can exhaust stack space and cause a denial of service. It can also disclose up to 21 bytes of stack memory into an intermediate file.
Who is exposed?
Systems using GIMP with the file-pix (ESM) plugin and processing untrusted PIX image files are exposed. The provided data does not identify affected or fixed GIMP versions.