CVE-2026-90948: Gimp: gimp: heap-based buffer overflow in ico loader via integer overflow in embedded png dimensions
A flaw was found in GIMP's ICO file loader. When processing an ICO file containing an embedded PNG image, an integer overflow can occur during the calculation of the required buffer size. This leads to an undersized buffer being allocated, causing a heap-based buffer overflow when the decoded pixel data is written. A remote attacker could exploit this by crafting a malicious ICO file, which, when opened, could lead to arbitrary code execution or a crash.
Other sources
A heap-based buffer overflow flaw was found in GIMP's ICO file loader. When processing an ICO file containing an embedded PNG image, ico-load.c calculates the required buffer size using an unchecked 32-bit signed multiplication of the image's width and height. Specially crafted dimensions can overflow this calculation, causing an undersized buffer to be allocated, while libpng continues decoding the image using the original, unvalidated dimensions. This results in a heap-based buffer overflow when the decoded pixel data is written past the end of the allocated buffer. An attacker could exploit this by crafting a malicious ICO file that, when opened in GIMP, leads to a crash or arbitrary code execution in the context of the user running GIMP.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What must an attacker do to trigger this issue?
An attacker must provide a crafted ICO file containing an embedded PNG with specially chosen dimensions, and the target must open that file in GIMP. The vulnerable calculation occurs while GIMP's ICO loader processes the embedded PNG image.
Is authentication or elevated privilege required for exploitation?
No authentication or privileges are required by the attacker. Exploitation requires user interaction because the malicious ICO file must be opened in GIMP.
What is the potential impact if exploitation succeeds?
The flaw can cause a heap-based buffer overflow in the context of the user running GIMP. The stated outcomes are a crash or arbitrary code execution with that user's privileges.