CVE-2026-90947: Gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset file
A flaw was found in GIMP. When processing a specially crafted lighting preset file, the Lighting Effects filter does not properly validate the number of light sources. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to open a malicious preset file, potentially causing a crash or enabling arbitrary code execution.
Other sources
A flaw was found in GIMP's Lighting Effects filter. When loading a lighting preset file, lighting-ui.c reads the number of light sources from the file using fscanf() without validating the return value or bounding the parsed count against the fixed-size array of light sources (NUMLIGHTS, 6 entries). A preset file specifying more than 6 light sources causes writes past the end of the lightsource array, corrupting memory. This issue could be triggered by convincing a user to open a specially crafted lighting preset file in GIMP, potentially leading to a crash or arbitrary code execution in the context of the user running GIMP.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the Lighting Effects preset loading logic (lighting-ui.c) to validate the fscanf() return value and to bound the parsed light source count against NUM_LIGHTS (fixed-size array of 6 entries) before processing.
GIMP Lighting Effects filter (lighting preset loading in lighting-ui.c) Number of light sources parsed from preset file = Bound to NUM_LIGHTS (=6) - Compensating control
Do not open untrusted GIMP Lighting Effects (lighting preset) files; only load presets from trusted sources to avoid triggering the out-of-bounds write in the lighting effects plugin.
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
The attacker must convince a user to open a specially crafted Lighting Effects preset file in GIMP. The malicious preset declares more than the supported six light sources, causing writes beyond the fixed-size light-source array.
Is this remotely exploitable without user interaction?
No. The supplied vector requires local interaction: a user must open the attacker-controlled preset file in GIMP. Any resulting code execution would occur in the context of the user running GIMP.
What can happen if a vulnerable GIMP instance processes a malicious preset?
Processing the preset can corrupt memory and crash GIMP. The issue may also enable arbitrary code execution with the permissions of the affected user.