REDHAT-BUG-2539980: High severity GIMP GIMP vulnerability
A flaw was found in GIMP's GIMPressionist plug-in. When loading a preset file, presets.c parses an attacker-controlled index with atoi() in setorientvector() and setsizevector() and uses it to write into pcvals.orientvectors[] and pcvals.sizevectors[] without checking that the index is within the fixed array bounds (MAXORIENTVECT and MAXSIZEVECT, 50 entries each). A crafted preset with an out-of-range or negative index causes writes past those arrays, corrupting memory. This issue can be triggered by convincing a user to load a specially crafted GIMPressionist preset, potentially leading to a crash or arbitrary code execution in the context of the user running GIMP. This is distinct from CVE-2026-90947, which addressed a similar missing bound check in the Lighting Effects plug-in. The issue is present in GIMP 3.2.6; a bounds check was added on the main branch.
Affected Software
Event History
Frequently Asked Questions
What must an attacker do to exploit this flaw?
The attacker must convince a user to load a specially crafted GIMPressionist preset file. The malformed preset supplies an out-of-range or negative index that is used without bounds checking.
Who is exposed to impact from a malicious preset?
Users running an affected GIMP installation who load an attacker-controlled GIMPressionist preset are exposed. Successful exploitation occurs in the security context of the user running GIMP and may cause a crash or arbitrary code execution.
Which preset fields are involved?
The issue affects indexes processed by set_orient_vector() and set_size_vector(). These indexes can write outside the 50-entry pcvals.orient_vectors[] and pcvals.size_vectors[] arrays.
Is a fix available?
A bounds check has been added on the main branch. The issue is reported as present in GIMP 3.2.6.