CVE-2026-82328: Gimp: heap out-of-bounds read in ico loader via unvalidated used_clrs palette count
A flaw was found in the file-ico plugin in GIMP, affecting all versions. When processing a specially crafted ICO image file, the plugin does not properly validate the usedclrs (palette count) parameter. This incorrect validation leads to improper memory bounds checking, resulting in a heap out-of-bounds read. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of heap memory contents.
Other sources
A flaw was found in the file-ico plugin in GIMP. When processing a specially crafted ICO image file, the plugin does not properly validate the usedclrs (palette count) parameter. This incorrect validation leads to improper memory bounds checking, resulting in a heap out-of-bounds read. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of heap memory contents.
— MITRE
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of GIMP who open or process ICO image files are exposed. The affected component is the file-ico plugin, and the issue is described as affecting all GIMP versions.
What does an attacker need to exploit it?
An attacker needs to convince a user to process a specially crafted ICO image file with GIMP. The attack requires user interaction, as reflected in the UI:R vector.
What could happen if exploitation succeeds?
Processing the crafted file can cause GIMP to read beyond heap-memory bounds. This may crash the application, causing denial of service, or disclose a limited amount of heap-memory contents.