[Pkg-gnome-extras-maintainers] Bug#1145872: gimp: CVE-2026-79902

[Salvatore Bonaccorso]

Source: gimp
Version: 3.2.4-3
Severity: important
Tags: security upstream
Forwarded: https://gitlab.gnome.org/GNOME/gimp/-/work_items/16582
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerability was published for gimp.

CVE-2026-79902[0]:
| A flaw was found in the Seattle FilmWorks plugin in GIMP. When
| processing a specially crafted SFW image file, the plugin allocates
| a Variable-Length Array (VLA) on the stack without integer overflow
| checks, causing an unbounded stack allocation. This issue leads to
| an application crash, resulting in a denial of service.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-79902
    https://www.cve.org/CVERecord?id=CVE-2026-79902
[1] https://gitlab.gnome.org/GNOME/gimp/-/work_items/16582
[2] https://gitlab.gnome.org/GNOME/gimp/-/commit/fa9503bcc41e41ac0a5ae162a97486c79a7790ce

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore