CVE-2026-40917 — Gimp: gimp: application crashes or information disclosure via crafted icns image files

CVE-2026-40917

Gimp: gimp: application crashes or information disclosure via crafted icns image files PUBLISHED

Description (CNA)

A flaw was found in GIMP. This vulnerability, a heap buffer over-read in the `icns_slurp()` function, occurs when processing specially crafted ICNS image files. An attacker could provide a malicious ICNS file, potentially leading to application crashes or information disclosure on systems that process such files.

Affected (CNA)

Vendor / product	Versions
Red Hat / Red Hat Enterprise Linux 6	affected
Red Hat / Red Hat Enterprise Linux 7	affected
Red Hat / Red Hat Enterprise Linux 8	affected
Red Hat / Red Hat Enterprise Linux 9	affected

CWE

CWE-125

References

https://access.redhat.com/security/cve/CVE-2026-40917
https://bugzilla.redhat.com/show_bug.cgi?id=2458746

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.