Bug 2533008 (CVE-2026-90948)

Summary: CVE-2026-90948 gimp: gimp: heap-based buffer overflow in ICO loader via integer overflow in embedded PNG dimensions
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in GIMP's ICO file loader. When processing an ICO file containing an embedded PNG image, an integer overflow can occur during the calculation of the required buffer size. This leads to an undersized buffer being allocated, causing a heap-based buffer overflow when the decoded pixel data is written. A remote attacker could exploit this by crafting a malicious ICO file, which, when opened, could lead to arbitrary code execution or a crash.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2533137    
Bug Blocks:    

Description OSIDB Bzimport 2026-09-14 12:04:25 UTC 
A heap-based buffer overflow flaw was found in GIMP's ICO file loader. When processing an ICO file containing an embedded PNG image, ico-load.c calculates the required buffer size using an unchecked 32-bit signed multiplication of the image's width and height. Specially crafted dimensions can overflow this calculation, causing an undersized buffer to be allocated, while libpng continues decoding the image using the original, unvalidated dimensions. This results in a heap-based buffer overflow when the decoded pixel data is written past the end of the allocated buffer. An attacker could exploit this by crafting a malicious ICO file that, when opened in GIMP, leads to a crash or arbitrary code execution in the context of the user running GIMP.