CoreCVE
Back

HIGH

GIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Published Feb 20, 2026

Description

GIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of XWD files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28265.

Affected products

Remediation

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Weaknesses (1)

CWE-787

Out-of-bounds Write

References (18)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner zdi
Published Feb 20, 2026
Updated Jul 15, 2026
Reserved Feb 6, 2026
Link CVE-2026-2045
CISA Vulnrichment
Updated Feb 21, 2026
NVD
Status Modified
Modified Jul 15, 2026
Link CVE-2026-2045
Red Hat
Severity Important
Public date Feb 20, 2026
Links CVE-2026-2045 - Bugzilla
ENISA EUVD
Assigner zdi
Published Feb 20, 2026
Updated Jul 15, 2026
Exploited since n/a
Link EUVD-2026-7575
EUVD-2026-7575