CVE-2026-97185: Gimp: gimp: out-of-bounds write in gimpressionist plugin via crafted preset file
A flaw was found in GIMP. When processing a specially crafted GIMPressionist preset file, the plug-in does not properly validate vector indices before writing into fixed-size arrays. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to load a malicious preset file, potentially causing a crash or enabling arbitrary code execution.
Other sources
A flaw was found in GIMP's GIMPressionist plug-in. When loading a preset file, presets.c parses an attacker-controlled index with atoi() in setorientvector() and setsizevector() and uses it to write into pcvals.orientvectors[] and pcvals.sizevectors[] without checking that the index is within the fixed array bounds (MAXORIENTVECT and MAXSIZEVECT, 50 entries each). A crafted preset with an out-of-range or negative index causes writes past those arrays, corrupting memory. This issue can be triggered by convincing a user to load a specially crafted GIMPressionist preset, potentially leading to a crash or arbitrary code execution in the context of the user running GIMP. This is distinct from CVE-2026-90947, which addressed a similar missing bound check in the Lighting Effects plug-in. The issue is present in GIMP 3.2.6; a bounds check was added on the main branch.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Users running GIMP who load a malicious GIMPressionist preset file are exposed. Exploitation occurs in the context of the user running GIMP.
What does an attacker need to exploit this issue?
An attacker needs to provide a specially crafted GIMPressionist preset and convince a user to load it. The reported vector requires local access and user interaction, and does not require privileges.
What can be done if patching is not immediately possible?
Do not load GIMPressionist preset files from untrusted sources. Treat externally supplied or downloaded presets as potentially malicious until a fix is available.
What is the likely impact of a successful exploit?
A crafted out-of-range or negative vector index can corrupt memory by writing past fixed-size arrays. This may crash GIMP or potentially allow arbitrary code execution as the affected user.