{"id":"CVE-2026-92183","kind":"vulnerability","aliases":["CVE-2026-92183"],"related":[],"title":"GIMP: APNG file parsing overflow lets a malicious file run code","description":"GIMP APNG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of APNG files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29400.","summary":"GIMP mishandles the length of data read from an APNG image, copying it into a fixed stack buffer without a bounds check. An attacker who gets a user to open or view a crafted file can run code in the GIMP process.","severity":"high","cvss":7.8,"epss":0.00363,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop","gimp","linux","macos","package","windows"],"not_affected_if":["gimp-not-installed","trusted-files-only"],"how_to_check":"- Run `gimp --version` on each workstation or server that has GIMP installed and compare against the fixed release.\n- unknown","fix":"- Upgrade GIMP to the fixed release listed by the vendor (version unknown from the sources).\n- Until patched, avoid opening APNG files from untrusted sources.","status":"open","published_at":"2026-10-21T18:17:30+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T03:08:17+00:00","updated_at":"2026-10-25T03:08:17+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:08:17Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade GIMP to the fixed release listed by the vendor (version unknown from the sources).\n- Until patched, avoid opening APNG files from untrusted sources.","reach":"internet","title":"GIMP: APNG file parsing overflow lets a malicious file run code","impact":"high","summary":"GIMP mishandles the length of data read from an APNG image, copying it into a fixed stack buffer without a bounds check. An attacker who gets a user to open or view a crafted file can run code in the GIMP process.","category":"package","nicknames":[],"who_cares":["gimp","desktop","linux","windows","macos"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs arbitrary code as the logged-in GIMP user","analyst_note":"Affected and fixed version ranges are missing; check the NVD entry and the ZDI advisory for ZDI-CAN-29400 to fill in how_to_check and fix.","how_to_check":"- Run `gimp --version` on each workstation or server that has GIMP installed and compare against the fixed release.\n- unknown","needs_analyst":true,"not_affected_if":["gimp-not-installed","trusted-files-only"],"who_is_affected":"Any installation of GIMP that parses APNG files can be affected, most often on desktops where users open images downloaded from the web or email. Systems where GIMP is not installed, or where users only open trusted files, have less exposure. The sources do not name specific versions.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000618,"input_tokens":3466,"output_tokens":542,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-92183':14A,17A '29400':172C 'affect':89C 'allow':81C 'apng':2A,33B,67C,123C 'arbitrari':86C 'attack':47B,83C,153C 'base':72C,150C 'bound':44B 'buffer':41B,73C,151C 'check':45B 'code':11A,61B,76C,87C,160C 'context':163C 'copi':35B,144C 'craft':57B 'current':166C 'cve':12A,15A 'data':29B,141C 'desktop':18B 'execut':77C,85C,159C 'exist':118C 'exploit':98C 'file':3A,9A,58B,68C,114C,124C 'fix':39B 'flaw':117C 'get':49B 'gimp':1A,19B,24B,64B,66C,92C 'imag':34B 'instal':90C 'interact':94C 'issu':126C 'lack':130C 'length':27B,136C 'let':6A 'leverag':155C 'linux':20B 'maco':21B 'malici':8A,108C,113C 'mishandl':25B 'must':105C 'open':53B,111C 'overflow':5A,74C 'packag':22B 'page':109C 'pars':4A,69C,121C 'prior':142C 'process':65B,167C 'proper':132C 'read':30B 'remot':75C,82C 'requir':96C 'result':127C 'run':10A,60B 'specif':116C 'stack':40B,71C,149C 'stack-bas':70C,148C 'suppli':140C 'target':104C 'user':51B,93C,139C 'user-suppli':138C 'valid':133C 'view':55B 'visit':106C 'vulner':78C,80C,100C,157C 'window':23B 'within':119C 'without':42B 'zdi':170C 'zdi-can':169C","nicknames":[],"mitigations":[],"who_affected":"Any installation of GIMP that parses APNG files can be affected, most often on desktops where users open images downloaded from the web or email. Systems where GIMP is not installed, or where users only open trusted files, have less exposure. The sources do not name specific versions.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T18:17:30+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92183","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92183","severity":null,"published_at":"2026-10-21T18:17:30+00:00","modified_at":"2026-10-23T12:18:18+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-92183","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92183","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}