CVE-2026-78475

Executive Summary

CVE-2026-78475 is a memory-safety vulnerability in the file-pix (ESM) plugin of GIMP, the GNU Image Manipulation Program. The flaw involves an unbounded stack allocation of a Variable-Length Array (VLA) during PIX image processing, resulting in a 21-byte stack over-read and potential stack exhaustion due to unbounded allocation. An attacker can craft a malicious PIX image file that, when opened by a victim, triggers a denial-of-service condition (stack exhaustion) and a limited information disclosure of stack memory contents written into an intermediate output file. The vulnerability requires local user interaction (opening a file), carries a CVSS base score of 6.1, and currently has no patch available from any tracked source.

Technical Analysis

The vulnerability resides in the file-pix (ESM) plugin component of GIMP, which is responsible for loading and processing image files in the PIX format. The NVD description identifies two interlinked memory-safety defects at the core of the issue:

1. Unbounded Stack Allocation via Variable-Length Array (VLA)

When the plugin processes a specially crafted PIX file, it allocates a Variable-Length Array (VLA) on the stack. VLA sizes are computed at runtime, and the plugin does not validate the computed size against any upper bound before performing the allocation. An attacker controlling the PIX file's metadata can influence the size computation. By setting the relevant dimension or count header fields to excessively large values, the attacker forces the plugin to request a stack allocation far beyond what the call stack can reasonably accommodate.

Stack allocations are bounded by the process's stack limit (typically 1-8 MB depending on OS and configuration). A sufficiently large VLA request will exceed this limit, causing stack exhaustion. On most platforms, this manifests as a stack overflow exception (e.g., SIGSEGV on Linux, access violation on Windows), which terminates the GIMP process — resulting in a denial-of-service condition.

2. 21-Byte Stack Over-Read (CWE-125)

The NVD description also documents a subsequent 21-byte stack over-read. This occurs after the VLA allocation, when the plugin reads data from the VLA's memory region. If the actual data written to the VLA by the file parser is shorter than the VLA's allocated size, or if an off-by-N calculation results in reads past the VLA's logical boundary, the plugin reads beyond the bounds of the allocated stack array into adjacent stack memory.

The over-read is precisely characterized as 21 bytes — the plugin reads 21 bytes past the intended boundary. This is a constrained, limited out-of-bounds read.

3. Information Disclosure into an Intermediate File

Critically, the 21 bytes of out-of-bounds stack memory are not directly leaked to the attacker via network or console output. Instead, they are written into an intermediate file. The file-pix plugin likely writes intermediate processing results (e.g., during decompression, format conversion, or pixel data transformation) to a temporary or cache file. The out-of-bounds read data contaminates this intermediate file, meaning that a subsequent user or process with access to that file could observe the leaked stack memory contents.

This disclosure is limited in two respects: (a) it is only 21 bytes per trigger, and (b) the attacker must gain access to the intermediate file to recover the leaked data. However, stack memory may contain sensitive material such as function return addresses (useful for ASLR bypass in a multi-stage attack), file paths, environment variable pointers, or fragments of previously processed data.

Attack Surface

• Attack vector: Local, requiring an interactive user session (AV:L)
• Attack complexity: Low — the attacker only needs to craft a malformed PIX file; no special conditions are required beyond the victim opening the file (AC:L)
• Privileges required: None — the attack does not pre-authenticate or require elevated privileges (PR:N)
• User interaction: Required — the victim must open the crafted file in GIMP (UI:R)

The vulnerability class (unbounded stack allocation + OOB read) is well-understood in memory-safety research. It is representative of the broader class of "memory exhaustion leading to DoS" and "stack-based information disclosure" defects that plague file parsers across image processing tools.

Exploitation Scenarios

Preconditions:

• Target system has GIMP installed with the file-pix (ESM) plugin available (default component of GIMP builds with PIX support).
• Attacker can deliver a malicious PIX file to the victim (via email, web download, USB, file share).
• Victim will open the file in GIMP (either directly or via file dialog).

No public PoC exists for this vulnerability. The attack chain below is inferred from the vulnerability class and the NVD description.

Step 1: Reconnaissance / Target Identification

The attacker identifies a target user or organization that uses GIMP for image editing. Reconnaissance may include:

• Determining installed GIMP versions via system inventory tools or user-reported versions.
• Identifying users who import bulk image files (e.g., graphic designers, QA testers, digital forensics analysts).
• Confirming that GIMP is associated with the PIX file format (documented file associations).
• Optionally, fingerprinting GIMP's plugin availability via plugin directory listings if the attacker has local access.

The attacker crafts the malicious PIX file. Since no specific file format details (field names, header offsets) are provided in the NVD description, the attacker would need to analyze the file-pix plugin source or reverse-engineer the binary to identify the exact header fields controlling the VLA size and trigger the 21-byte over-read.

Step 2: Triggering the Flaw

The attacker delivers the malicious PIX file to the victim through standard social engineering channels (phishing email with attachment, malicious website link, shared drive). When the victim opens the file with GIMP, the file-pix plugin begins parsing the PIX container.

At the vulnerability-class level, the parsing sequence is:

1. The plugin reads the PIX header/metadata.
2. It derives a size value from attacker-controlled header fields (e.g., image width, height, or a data-length field).
3. It computes the VLA size using this unchecked value.
4. It declares and allocates a VLA uint8_t buffer[size] (or equivalent) on the stack.
5. If the size exceeds the stack limit, stack exhaustion occurs immediately, crashing GIMP.
6. If the size is within the stack limit, the plugin continues processing, copying image data into the VLA.
7. During a later read operation (e.g., a bit-stream decoder or pixel unpacker), the plugin reads 21 bytes past the VLA's boundary due to insufficient bounds checking in the read logic.

Step 3: Payload / Execution at Vulnerability-Class Level

Denial of Service: The primary payload is the file itself — no additional code execution is achieved. The crafted header value forces a stack allocation exceeding the OS stack limit, terminating GIMP. This is a pure DoS.

Information Disclosure: For the over-read path, the plugin performs an OOB read of 21 bytes beyond the VLA. These bytes are then written to an intermediate file during the plugin's processing pipeline. The attacker's objective shifts to retrieving that intermediate file. The file may persist in a temp directory (e.g., /tmp/, %TEMP%) or in GIMP's cache directory. If the attacker has local access or the file is left behind after the crash, they can inspect it for leaked stack data — which may contain function pointers, addresses, or other sensitive data.

Step 4: Post-Exploitation Impact

• Denial of Service: The victim's GIMP session crashes. Any unsaved work is lost. If GIMP is used in a production pipeline (batch image processing), the crash may halt an automated job — a business disruption.

• Limited Information Disclosure: The 21 bytes of leaked stack memory are written to an intermediate file. If recovered, they may reveal:

  • Stack canary values (in some configurations), potentially enabling stack-buffer-overflow exploitation in chained attacks.
  • Return addresses that leak ASLR base addresses for the GIMP binary or loaded libraries, which could assist a follow-up exploitation of a separate memory-corruption bug to achieve code execution.
  • Fragments of prior stack data from the same thread — potentially including file paths, network credentials, or other process-local secrets.

• Chained Attack Potential: While this vulnerability alone does not yield arbitrary code execution, the information disclosure could be used as an intelligence-gathering step to defeat ASLR in a multi-stage exploit chain targeting a second vulnerability in GIMP or its plugins. No public exploit chains are currently known.

Impact Assessment

CVSS Score: 6.1 (Medium)

The CVSS vector breaks down as:

• Attack Vector: Local (AV:L) — the attacker must deliver a file to a local user; no network exploitation.
• Attack Complexity: Low (AC:L) — no special conditions, race conditions, or exotic requirements.
• Privileges Required: None (PR:N) — does not require authenticated access.
• User Interaction: Required (UI:R) — requires the victim to open the file in GIMP.
• Scope: Unchanged (S:U) — the compromise is confined to the vulnerable software component.
• Confidentiality Impact: Low (C:L) — 21 bytes of stack memory per trigger, written to an intermediate file, requiring additional access to retrieve; limited data sensitivity.
• Integrity Impact: None (I:N) — no data modification occurs.
• Availability Impact: High (A:H) — the vulnerability's primary impact is full GIMP process termination due to stack exhaustion, which is a complete loss of availability for the application.

Business Impact:

• Availability: For individual users, a crashed GIMP session with loss of unsaved work is a moderate nuisance. For organizations running GIMP in automated image-processing pipelines (e.g., media companies, CAD conversion, scientific imaging), a single malicious file can halt batch processing, causing cascading delays in dependent workflows.
• Confidentiality: The 21-byte stack leak is limited per trigger, but repeated parsing of multiple crafted files could accumulate more leaked data. In environments where GIMP is used to process sensitive documents (e.g., graphic design firms under NDA, government/military imagery), the leak of stack pointers could enable further targeted exploitation.
• Reputation / Compliance: If the intermediate file with leaked data is accessible by unauthorized parties, it may constitute a data disclosure event under privacy regulations, depending on the leaked content.

Affected Systems:

• All GIMP installations incorporating the file-pix (ESM) plugin.
• No specific version range is known — affected versions are undefined at this time.
• No OS-specific limitations are documented; any platform where GIMP runs is potentially affected.

Blast Radius:

• Confined to the local host where the malformed file is opened.
• No network propagation.
• No worm-like spread potential.

EPSS: Not yet scored by FIRST.org — no active exploitation probability metric is available.

CISA KEV: Not listed — the vulnerability has not been confirmed as actively exploited in the wild by CISA's Known Exploited Vulnerabilities catalog.

Detection Guidance

The following detection rules are hypothetical — no public exploits, PoCs, or signature data exist for this vulnerability. Rules are built from the general characteristics of: (a) malicious PIX file processing (crash signatures), (b) stack exhaustion events, and (c) suspicious GIMP process behavior.

Sigma Rule

title: GIMP file-pix Stack Exhaustion / Over-Read Attempt (CVE-2026-78475)
id: 17a08c5e-7bf0-4bc8-a3e1-1ecf9d24a3de
status: experimental
description: Detects GIMP process crashes and anomalous memory behavior consistent with CVE-2026-78475 stack exhaustion and OOB read when processing malformed PIX files.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-78475
author: Valters IT Security Team
date: 2026/01/01
logsource:
    category: process_creation
    product: windows
detection:
    selection_crash:
        Image|endswith: '\\gimp-2.10.exe'
        # On Linux/macOS adjust to /usr/bin/gimp, /Applications/GIMP.app/Contents/MacOS/GIMP
    selection_context:
        EventID: 1000    # Windows Error Reporting - Application Crash
        | contains: '0xc0000409'  # STATUS_STACK_BUFFER_OVERRUN (common for stack exhaustion)
    condition: selection_crash and selection_context
    falsepositives:
        - Legitimate large image files causing genuine memory pressure
        - Other bugs in GIMP causing stack overflow
level: medium
tags:
    - attack.t1204.002
    - cve.2026.78475

YARA Rule

rule CVE_2026_78475_PIX_MALFORMED {
    meta:
        author = "Valters IT Security"
        description = "Detect suspicious PIX header structures associated with GIMP file-pix VLA stack exhaustion (CVE-2026-78475). Rule is heuristic — PIX headers are not well documented in public sources."
        cve = "CVE-2026-78475"
        date = "2026-01-01"
    strings:
        // PIX / ESM magic bytes (heuristic — the ESM plugin reads a specific signature)
        // If the PIX format uses a recognizable magic (e.g., "PIX1", "ESM ", or binary header) — not
        // confirmed in available description. Flag only if found in combination with excessive sizes.
        $magic_a = { 50 49 58 }          // "PIX"
        $magic_b = { 45 53 4D }          // "ESM"

        // Common crash-inducing large dimension values in 32-bit LE integer fields
        // e.g., 0xFFFFFFFF (4294967295) as width/height/logical length
        $hdr_max_u32 = { FF FF FF FF }
        $hdr_0x7FFFFFFF = { FF FF FF 7F }  // 2147483647 — often largest signed int accepted

    condition:
        uint16(0) == 0x4B50 or        // "PK" alternative PIX header OR
        (filesize > 32 and filesize < 1024*1024 and
         (1 of ($magic_*) or filesize >= 16) and
         any of ($hdr_*) ) and
        // Heuristic: file is small but declares very large dimensions
        // We cannot verify without full format docs — this is a heuristic alert
        filesize < 1000000
}

Caveat: The YARA rule above is a heuristic placeholder. Without the actual PIX/ESM file format specification, precise header offsets for the size fields that trigger VLA allocation are unknown. The rule flags files with PIX-like magic bytes and maximum-sized integer fields, which is consistent with an attempt to force stack exhaustion. This will produce false positives on legitimate large-image PIX files.

Suricata IDS Rule

alert http any any -> any any (msg:"GIMP PIX File Download Attempt — Potential CVE-2026-78475 Malicious Payload Download"; flow:to_client,established; content:"|50 49 58|"; http.response_body; classtype:attempted-dos; sid:20267847501; rev:1;)

A note on Suricata applicability: This is a local file-processing vulnerability. Network IDS detection is inherently limited because:

1. The malicious file is delivered out-of-band (email, USB, shared drive), not over HTTP/SMB monitored by the IDS in most cases.
2. The trigger occurs at file-parse time on the local host — no network indicator exists during exploitation.

The rule above only flags HTTP downloads of files containing the "PIX" magic bytes on the response body, which is a weak indirect signal. Recommended: Use host-based detection (Sigma, EDR) as primary coverage.

Elastic Detection

// Detect GIMP process crashes consistent with stack exhaustion
// Requires Elastic Endpoint or Winlogbeat with Windows Event Logs
sequence by host.name with maxspan=5m
  [ process where event.type == "start" and process.name : "*gimp*" ]
  [ any where
      (event.provider == "Microsoft-Windows-WER-SystemErrorReporting" and event.code == 1001) or
      (event.provider == "Application Error" and event.code == 1000 and
       wildcard(message, "*stack*") or wildcard(message, "*0xc0000409*")) ]

This EQL rule looks for a GIMP process start followed by a Windows Error Reporting event indicating a stack-related crash (0xc0000409 = STATUS_STACK_BUFFER_OVERRUN). On Linux hosts, look for:

// Linux: segfault followed by core dump or kernel oops
sequence by host.name with maxspan=5m
  [ process where event.type == "start" and process.name : "*gimp*" ]
  [ any where event.category == "process" and
      wildcard(process.name, "*gimp*") and
      (event.action == "segfault" or event.code == "SIGSEGV") ]

Splunk SPL Query

index=windows EventCode=1000
| search Message="*gimp*" OR Image="*gimp*.exe"
| rename Image as process_path
| search Message="*0xc0000409*" OR Message="*stack*" OR Message="*unhandled exception*"
| stats count by host, process_path, _time
| sort - _time

// Linux variant — journald/syslog for segfaults in GIMP
index=linux sourcetype=journald OR sourcetype=syslog
| search "gimp" AND ("segfault" OR "SIGSEGV" OR "stack overflow")
| eval indicator = case(
      like(_raw, "%stack overflow%"), "stack_exhaustion_candidate",
      like(_raw, "%segfault%"), "segfault_candidate",
      1=1, "gimp_crash")
| stats count by host, indicator, process

Wazuh OSSEC Rule

<group name="gimp,cve-2026-78475,">
  <!-- Detect GIMP crash on Linux/macOS via systemd journal -->
  <rule id="100284" level="10">
    <decoded_as>json</decoded_as>
    <field name="program">systemd-coredump</field>
    <match>gimp</match>
    <regex>SIGSEGV|stack overflow|segmentation fault</regex>
    <description>GIMP process crashed with stack exhaustion signature — possible CVE-2026-78475 exploitation attempt (malicious PIX file)</description>
    <group>pci_dss_11.4,gdpr_article_33,</group>
    <mitre>
      <id>T1204.002</id>
    </mitre>
  </rule>

  <!-- Detect GIMP crash on Windows via WER events -->
  <rule id="100285" level="10">
    <if_sid>92050</if_sid>  <!-- Windows Application Error event -->
    <field name="win.eventdata.image">.*gimp.*</field>
    <match>0xc0000409</match>
    <description>GIMP stack buffer overrun (0xc0000409) — possible CVE-2026-78475 malicious PIX file processing</description>
    <group>pci_dss_11.4,gdpr_article_33,</group>
    <mitre>
      <id>T1204.002</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: UNPATCHED

Patch confidence is 0/4 — no patch evidence exists from any tracked source (NVD, vendor advisories, GitHub commits, Debian/Ubuntu/RedHat security trackers, or third-party monitors). No vendor fix, no affected version range, and no workarounds are documented.

1. Immediate Mitigations

• Restrict PIX file processing: If GIMP is used in your environment, identify and block PIX-related workflows if they are not business-critical. Train users not to open image files from untrusted sources.
• Control file delivery: Deploy email attachment filtering and web content filtering to block .pix and .esm extensions (and any related extensions used by the ESM plugin) from untrusted senders.
• Isolate GIMP execution: Run GIMP in a sandboxed environment (containers, AppArmor/SELinux policies, Windows Sandbox) to limit the impact of stack exhaustion crashes and confine any leaked intermediate files to a non-sensitive location.
• Disable the file-pix plugin: If PIX format support is not required, remove or disable the plugin:
  • On Linux: move/rename file-pix binary from /usr/lib/gimp/2.0/plug-ins/ (path may vary by distro).
  • On Windows: remove from <GIMP_INSTALL_DIR>/lib/gimp/2.0/plug-ins/.
  • This prevents GIMP from loading PIX files at all, eliminating the attack surface.
• Monitor crash events: Implement the detection rules above to alert on GIMP crashes — investigate any anomaly as a possible exploitation attempt.
• Control access to intermediate/temp files: Ensure GIMP's temp directory (/tmp/gimp/ on Linux, %TEMP%\gimp on Windows) has restrictive permissions so that leaked stack data in intermediate files cannot be read by unauthorized local users.

2. Patch / Upgrade Steps

• No patch is available. Monitor the following sources for updates:
  • GIMP official website (gimp.org) and GNOME git repository
  • NVD entry CVE-2026-78475 for patch linkage
  • Distro security trackers (Ubuntu CVE tracker, Debian Security Tracker, Red Hat CVE database)
• When a fix ships: Upgrade to the patched GIMP version immediately. Validate that the fixed version no longer contains the unbounded VLA allocation or the 21-byte over-read.
• If you maintain a GIMP fork/private build: Patch the file-pix plugin to (a) validate incoming header dimensions against a configurable maximum before VLA allocation, and (b) perform bounds checks on all reads from the VLA, ensuring reads never exceed the allocated array size.

3. Long-Term Hardening

• Attack surface reduction: Review all GIMP plugins (not just file-pix) for similar unbounded stack allocation patterns. The VLA-on-stack pattern is an anti-pattern for security — prefer heap allocation with size validation or bounded fixed-size buffers.
• Memory safety: Consider compiling GIMP with stack-protector flags, FORTIFY_SOURCE, and hardened allocator settings, which may convert stack overflows into detectable aborts rather than silent corruption (mitigation, not a fix).
• File-type allow-listing: In enterprise environments, restrict image file types to a known-good set (PNG, JPEG, TIFF). Block exotic formats like PIX unless explicitly required.
• User training: Reinforce the principle of not opening image files from untrusted sources — especially niche formats like PIX that average users will never legitimately receive.
• Vulnerability management cadence: Add GIMP to your CVE monitoring list in your vulnerability management tool (if not already present) so that when a patch is released, deployment occurs within your defined SLA.

References

1. NVD Entry — CVE-2026-78475
   https://nvd.nist.gov/vuln/detail/CVE-2026-78475
   Official NVD vulnerability record containing the CVSS vector, CWE, and description.

2. MITRE CVE Record — CVE-2026-78475
   https://www.cve.org/CVERecord?id=CVE-2026-78475
   Authoritative CVE record as maintained by MITRE CNA coordination.

3. CWE-125 — Out-of-bounds Read
   https://cwe.mitre.org/data/definitions/125.html
   Referenced weakness class for the stack over-read component of this vulnerability.

4. GIMP Official Website
   https://www.gimp.org
   Primary vendor resource — monitor for security announcements and patch releases.

5. GIMP Git Repository (GNOME GitLab)
   https://gitlab.gnome.org/GNOME/gimp
   Source code location where a future fix will be committed; the file-pix plugin source lives under the plug-ins/ directory.

Threat Actor / Exploit-in-the-Wild Status: No known threat actor campaigns referencing CVE-2026-78475 have been identified as of the writing date. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. No exploit code, PoC, or Nuclei template exists publicly. EPSS has not yet assigned a score. Exploitation is assessed to be theoretical at this time, limited by the need for social engineering (file delivery) and user interaction (opening the file).