{"id":"CVE-2026-97185","state":"PUBLISHED","title":"Gimp: gimp: out-of-bounds write in gimpressionist plugin via crafted preset file","description":"A flaw was found in GIMP. When processing a specially crafted GIMPressionist preset file, the plug-in does not properly validate vector indices before writing into fixed-size arrays. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to load a malicious preset file, potentially causing a crash or enabling arbitrary code execution.","publishedAt":"2026-09-24T08:30:29.489Z","updatedAt":"2026-10-19T12:20:03.875Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"redhat"},"assigner":"redhat","products":["Red Hat Red Hat Enterprise Linux 8","Red Hat Red Hat Enterprise Linux 9","Red Hat Red Hat Enterprise Linux 10","Red Hat Red Hat Enterprise Linux 6","Red Hat Red Hat Enterprise Linux 7"],"affected":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"gimp:2.8","defaultStatus":"affected","versions":[{"version":"8100020261015094823.4c9c024f","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"gimp","defaultStatus":"affected","versions":[{"version":"2:3.0.4-4.el9_8.14","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"gimp","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"gimp","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"gimp","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]}],"references":["https://access.redhat.com/errata/RHSA-2026:75575","https://access.redhat.com/errata/RHSA-2026:84744","https://access.redhat.com/security/cve/CVE-2026-97185","https://bugzilla.redhat.com/show_bug.cgi?id=2539980","https://gitlab.gnome.org/GNOME/gimp/-/work_items/16788"],"weaknesses":["CWE-787"],"ingestedAt":"2026-10-29T20:13:43.249Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/97xxx/CVE-2026-97185.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-97185","state":"PUBLISHED","datePublished":"2026-09-24T08:30:29.489Z","dateUpdated":"2026-10-19T12:20:03.875Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2026-09-24T08:09:01.599Z"},"containers":{"cna":{"title":"Gimp: gimp: out-of-bounds write in gimpressionist plugin via crafted preset file","descriptions":[{"lang":"en","value":"A flaw was found in GIMP. When processing a specially crafted GIMPressionist preset file, the plug-in does not properly validate vector indices before writing into fixed-size arrays. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to load a malicious preset file, potentially causing a crash or enabling arbitrary code execution."}],"affected":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"gimp:2.8","defaultStatus":"affected","versions":[{"version":"8100020261015094823.4c9c024f","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"gimp","defaultStatus":"affected","versions":[{"version":"2:3.0.4-4.el9_8.14","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"gimp","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"gimp","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"gimp","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:75575","name":"RHSA-2026:75575","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:84744","name":"RHSA-2026:84744","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-97185","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2539980","name":"RHBZ#2539980","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://gitlab.gnome.org/GNOME/gimp/-/work_items/16788"}],"metrics":[{"other":{"content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-787","description":"Out-of-bounds Write","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2026-10-19T12:20:03.875Z"},"datePublic":"2026-09-24T00:00:00.000Z","x_redhatCweChain":"CWE-787: Out-of-bounds Write","workarounds":[{"lang":"en","value":"Do not load GIMPressionist preset files from untrusted sources."}],"timeline":[{"lang":"en","time":"2026-09-24T08:06:24.381Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-09-24T00:00:00.000Z","value":"Made public."}],"credits":[{"lang":"en","value":"Red Hat would like to thank Harsh Verma for reporting this issue."}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-09-24T12:38:43.555462Z","id":"CVE-2026-97185","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-24T12:38:52.056Z"}}]}}}