Heap-based buffer overflow in Gimp - CVE-2026-2049

Vulnerability identifier: #VU124069

CSH Severity: Medium

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-2049

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the parsing of HDR files. A remote attacker can trick a victim to open a specially crafted file, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Gimp
SUSE Linux Enterprise Server 12 SP5
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
Debian Linux
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Workstation Extension 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Package Hub 15
openSUSE Leap
gegl-devel
typelib-1_0-Gegl-0_3
libgegl-0_3-0-debuginfo
gegl-0_3
gegl-debugsource
gegl-0_3-debuginfo
gegl-debuginfo
libgegl-0_3-0
gegl (Debian package)
gegl-doc
libgegl-0_4-0-64bit
libgegl-0_4-0-64bit-debuginfo
libgegl-0_4-0-32bit
libgegl-0_4-0-32bit-debuginfo
gegl
gegl-0_4-lang
typelib-1_0-Gegl-0_4
libgegl-0_4-0-debuginfo
libgegl-0_4-0
gegl-0_4-debuginfo
gegl-0_4

Install updates from vendor's website.

gegl-devel - addressed in versions 0.2.0-15.14.2, 0.4.46-150600.4.8.2
typelib-1_0-Gegl-0_3 - update to 0.3.34-150000.3.9.1
libgegl-0_3-0-debuginfo - update to 0.3.34-150000.3.9.1
gegl-0_3 - update to 0.3.34-150000.3.9.1
gegl-debugsource - addressed in versions 0.3.34-150000.3.9.1, 0.4.46-150600.4.8.2
gegl-0_3-debuginfo - update to 0.3.34-150000.3.9.1
gegl-debuginfo - addressed in versions 0.3.34-150000.3.9.1, 0.4.46-150600.4.8.2
libgegl-0_3-0 - update to 0.3.34-150000.3.9.1
gegl (Debian package) - addressed in versions 1:0.4.42-2+deb12u2, 1:0.4.62-2+deb13u2
gegl-doc - update to 0.4.46-150600.4.8.2
libgegl-0_4-0-64bit - update to 0.4.46-150600.4.8.2
libgegl-0_4-0-64bit-debuginfo - update to 0.4.46-150600.4.8.2
libgegl-0_4-0-32bit - update to 0.4.46-150600.4.8.2
libgegl-0_4-0-32bit-debuginfo - update to 0.4.46-150600.4.8.2
gegl - update to 0.4.46-150600.4.8.2
gegl-0_4-lang - update to 0.4.46-150600.4.8.2
typelib-1_0-Gegl-0_4 - update to 0.4.46-150600.4.8.2
libgegl-0_4-0-debuginfo - update to 0.4.46-150600.4.8.2
libgegl-0_4-0 - update to 0.4.46-150600.4.8.2
gegl-0_4-debuginfo - update to 0.4.46-150600.4.8.2
gegl-0_4 - update to 0.4.46-150600.4.8.2

• https://www.zerodayinitiative.com/advisories/ZDI-26-214/

• Multiple vulnerabilities in GIMP
• Debian update for gegl
• SUSE update for gegl
• SUSE update for gegl
• SUSE update for gegl