Description (CNA)
A flaw was found in the file-fits plugin in GIMP. When processing a FITS image file, the plugin calculates memory allocation sizes using signed 32-bit integers for width and height. If a crafted file sets both values to large values, their product exceeds 2^31 and overflows, resulting in an undersized heap-based buffer allocation. This integer overflow issue results in a heap-based buffer overflow when cfitsio subsequently writes a full row of pixels in the buffer, causing memory corruption, potentially leading to arbitrary code execution or a denial of service.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| GNOME / GIMP | affected |
| Red Hat / Red Hat Enterprise Linux 8 | unaffected 8100020260824165450.4c9c024f before * |
| Red Hat / Red Hat Enterprise Linux 9 | unaffected 2:3.0.4-4.el9_8.9 before * |
| Red Hat / Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | unaffected 2:2.99.8-4.el9_4.19 before * |
| Red Hat / Red Hat Enterprise Linux 9.6 Extended Update Support | unaffected 2:2.99.8-4.el9_6.20 before * |
| Red Hat / Red Hat Enterprise Linux 6 | affected |
| Red Hat / Red Hat Enterprise Linux 7 | affected |
CWE
CWE-190
References
- https://access.redhat.com/errata/RHSA-2026:50817
- https://access.redhat.com/errata/RHSA-2026:62507
- https://access.redhat.com/errata/RHSA-2026:73768
- https://access.redhat.com/errata/RHSA-2026:80509
- https://access.redhat.com/security/cve/CVE-2026-66758
- https://bugzilla.redhat.com/show_bug.cgi?id=2507475
- https://gitlab.gnome.org/GNOME/gimp/-/issues/16528
ADP enrichment
No English description supplied.
No references supplied.