[Pkg-gnome-extras-maintainers] Bug#1145874: gimp: CVE-2026-78475

[Salvatore Bonaccorso]

Source: gimp
Version: 3.2.4-3
Severity: important
Tags: security upstream
Forwarded: https://gitlab.gnome.org/GNOME/gimp/-/work_items/16580
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerability was published for gimp.

CVE-2026-78475[0]:
| A flaw was found in the file-pix (ESM) plugin in GIMP. When
| processing a specially crafted PIX image file, the plugin allocates
| a Variable-Length Array (VLA) on the stack without proper bounds
| checking, causing an unbounded stack allocation followed by a
| 21-byte stack over-read. This can result in a denial of service due
| to stack exhaustion and a limited information disclosure of stack
| memory contents into an intermediate file.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-78475
    https://www.cve.org/CVERecord?id=CVE-2026-78475
[1] https://gitlab.gnome.org/GNOME/gimp/-/work_items/16580
[2] https://gitlab.gnome.org/GNOME/gimp/-/commit/27d83534e637cf160f913ac6d6388d5a5555e9d8

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore