GIMP: Stack-based buffer overflow in APNG file parsing
Summary
GIMP, the open-source image editor, contains a stack-based buffer overflow in its APNG (animated PNG) parser. The flaw results from missing validation of the length of user-supplied data before it is copied to a stack buffer. An attacker can exploit it by getting a user to open a malicious APNG file or visit a malicious page, which may lead to code execution in the context of the GIMP process.
Affected
- GIMP 3.2.2 (listed as affected in the CNA record)
- Other versions: unknown; the affected range is not confirmed beyond 3.2.2
- Distribution packages: Ubuntu marks 26.10 as not affected; other releases are under evaluation
Fixed in
- Fixed version number: Unknown.
- Vendor fix: GitLab commit 175e28961a4679be8762a2d4d5a297faa82aebd9
Workaround
- No vendor-issued workaround found.
- Until a fixed build is installed, do not open APNG or untrusted image files from unknown sources.
- Generic advice from third parties: disable APNG support or block APNG files where feasible.
Exploitation
- Exploited in the wild: no evidence found.
- CISA SSVC: exploitation none, automatable no.
- Not listed in KEV according to a third-party database.
- Public proof of concept: none found.
Our recommendation
- Inventory all GIMP installations, including version and packaging source (distribution, Flatpak, Snap or Windows installer).
- Update GIMP to the latest vendor release and verify the fixed build against the release notes or the vendor commit.
- Until patched, restrict opening APNG and PNG files from untrusted sources.
- Recheck the NVD entry, which was still awaiting analysis at the time of research.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- ZDI-26-713 advisory www.zerodayinitiative.com
- GIMP commit 175e2896 gitlab.gnome.org
- Ubuntu security notice CVE-2026-92183 ubuntu.com
- OpenCVE CVE-2026-92183 app.opencve.io
- Debian security tracker: gimp security-tracker.debian.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 22:45.
Original description (NVD)
GIMP APNG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of APNG files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29400.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.