VulnSocial

CVE-2026-66758General(gimp / enterprise_linux)

LOWCVSS 7.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch gimp enterprise_linux systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A flaw was found in the file-fits plugin in GIMP. When processing a FITS image file, the plugin calculates memory allocation sizes using signed 32-bit integers for width and height. If a crafted file sets both values to large values, their product exceeds 2^31 and overflows, resulting in an undersized heap-based buffer allocation. This integer overflow issue results in a heap-based buffer overflow when cfitsio subsequently writes a full row of pixels in the buffer, causing memory corruption, potentially leading to arbitrary code execution or a denial of service.

gimp CVEsBack to dashboard
1.0/ 10 priority

Sources & remediation

Exploit / PoC references
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-190

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • enterprise_linux
  • gimp

Threat summary

  • Patch or workaround signal is available
  • 4 mentions across 4 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 2 signals
  • General: 2 classified signals
  • Disclosure: 2 classified signals
  • Peaked 3d ago at 1 mentions (2026-07-27); latest day: 1
  • 4 total mentions across 4 days

Affected systems

Vendors
gimpredhat
Products
enterprise_linuxgimp

6 versions affected across 2 products

Deep dive

Activity timeline4 mentions / 4d
00111Mentions · 2026-07-27: 1Mentions · 2026-07-28: 1Mentions · 2026-08-08: 1Mentions · 2026-10-20: 1Patch / Workaround · 2026-07-28: 1Patch / Workaround · 2026-10-20: 1Technical Details · 2026-07-28: 1Technical Details · 2026-10-20: 107-2707-2808-0810-20
Signal classification2 categories
General
250.0%
Disclosure
250.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-07-271
General1
2026-07-281
Disclosure1
2026-08-081
General1
2026-10-201
Disclosure1
Full discourse4 posts
  • Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters
    Disclosure

    CVE-2026-66758 - Heap buffer overflow in File-Fits (GIMP plugin). Integer overflow leads to memory corruption. #CVSS 7.8. No patch yet. Update GIMP and avoid untrusted FITS files. #CVE #infosec #GIMP #cybersecurity #CVEAlert #devsecops #developer #developers #wordpress #git #github #gitlab https://www.valtersit.com/cve/CVE-2026-66758

    Post summary

    The post announces CVE‑2026‑66758, a heap buffer overflow in the File‑Fits GIMP plug‑in, warns of no current patch, and advises updating GIMP and avoiding untrusted FITS files.

    01030395
    1.1K followersView on X
  • DFIR Lab@DFIR_Lab
    Disclosure

    🚨 HIGH: CVE-2026-66758 (CVSS 7.8) - Integer overflow in GIMP file-fits plugin leads to heap buffer overflow. Crafted FITS files can trigger memory corruption → RCE/DoS. Patch GIMP immediately. #CVE #Vulnerability #PatchNow https://t.co/GzNQBmpKWw

    Post summary

    A tweet announcing CVE-2026-66758 (CVSS 7.8), an integer overflow in GIMP's file-fits plugin leading to heap buffer overflow and potential RCE/DoS via crafted FITS files, with an urgent call to patch GIMP but no named fix version or advisory.

    0000032
    150 followersView on X
  • DailyCVE@dailycve
    General

    🔴 GIMP, Integer Overflow, #CVE-2026-66758 (High) -DC-Aug2026-1475 https://dailycve.com/gimp-integer-overflow-cve-2026-66758-high-dc-aug2026-1475/

    Post summary

    The post simply announces the existence of CVE‑2026‑66758 with minimal details, lacking evidence of PoC, exploitation, or mitigation.

    0000059
    226 followersView on X
  • VulDB 🛡@vuldb
    General

    The severity is increased for this new vulnerability affecting Red Hat Enterprise Linux (CVE-2026-66758) https://vuldb.com/vuln/383549

    Post summary

    A severity increase has been announced for CVE‑2026‑66758 on RHEL, but no further technical or exploitation details are provided.

    0000092
    2.3K followersView on X
CPE platform detail6 entries

6 of 6 entries

PartVendorProductVersionTarget SWTarget HW
Appgimpgimp3.0.8--
Appgimpgimp3.2.4--
OSredhatenterprise_linux6.0--
OSredhatenterprise_linux7.0--
OSredhatenterprise_linux8.0--
OSredhatenterprise_linux9.0--

Explore more

Back to dashboardgimp CVEsredhat CVEsenterprise_linux vulnerabilities