CVE-2026-82324: Gimp: heap out-of-bounds reads in iff/ilbm loader from ham row size mismatch and nplanes=0
A flaw was found in the file-iff (IFF/ILBM) plugin in GIMP, affecting versions 3.0.0 and newer. When processing a specially crafted IFF/ILBM image file, the plugin does not properly validate the HAM row size and improperly handles cases where the number of color planes (nPlanes) is zero. This causes a row size mismatch that bypasses memory bounds checking, resulting in heap out-of-bounds reads. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of heap memory contents.
Other sources
A flaw was found in the file-iff (IFF/ILBM) plugin in GIMP. When processing a specially crafted IFF/ILBM image file, the plugin does not properly validate the HAM row size and improperly handles cases where the number of color planes (nPlanes) is zero. This causes a row size mismatch that bypasses memory bounds checking, resulting in heap out-of-bounds reads. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of heap memory contents.
— MITRE
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
GIMP 3.0.0 and newer are affected when the file-iff plugin processes IFF/ILBM image files.
What is required to trigger the flaw?
An attacker needs to provide a specially crafted IFF/ILBM image that is processed by GIMP. The vector is local and requires user interaction, but no attacker privileges are required.
What impact should be expected from successful exploitation?
Processing the crafted image can cause GIMP to crash, resulting in denial of service. It may also disclose a limited amount of heap memory contents.