Gimp: gimp: stack buffer overflow in pnmscanner_gettoken()
Historical advisory recorded 2 Nov 2026 10:57:17 UTC. Read the latest advisory.
cve-program · CVE-2026-58380
PublishedA flaw was found in GIMP's PNM file format parser. When parsing a specially crafted PNM file, the pnmscanner_gettoken() function writes a null terminator one byte past the end of a stack-allocated buffer due to an off-by-one error in the loop boundary check. This could lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.
Read the publisher's advisoryAffected versions, risk and source history
cve-program · CVE-2026-58380
PublishedGimp: gimp: stack buffer overflow in pnmscanner_gettoken()
A flaw was found in GIMP's PNM file format parser. When parsing a specially crafted PNM file, the pnmscanner_gettoken() function writes a null terminator one byte past the end of a stack-allocated buffer due to an off-by-one error in the loop boundary check. This could lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.
- Source published
- 6 Jul 2026 13:58:43 UTC
- Source modified
- 2 Nov 2026 09:59:02 UTC
- Saved here
- 2 Nov 2026 10:57:17 UTC
- Source terms
- CVE Program Terms of Use
Original source record · Cite this exact observation · Complete original publisher JSON
Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
CVSS 3.1 · 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H