| Name | CVE-2026-6695 |
| Description | A flaw was found in GIMP. A remote attacker could exploit this by tricking a user into opening a specially crafted PAA (Paint Shop Pro Array) image file. This vulnerability, a heap-based out-of-bounds write in the decode_lzss() function of the PAA file format plugin, allows data to be written beyond the intended memory buffer. This could lead to heap metadata corruption and potentially enable the attacker to execute arbitrary code on the affected system. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| gimp (PTS) | bullseye | 2.10.22-4+deb11u2 | fixed |
| bullseye (security) | 2.10.22-4+deb11u8 | fixed | |
| bookworm, bookworm (security) | 2.10.34-1+deb12u10 | fixed | |
| trixie | 3.0.4-3+deb13u9 | fixed | |
| trixie (security) | 3.0.4-3+deb13u8 | fixed | |
| forky, sid | 3.2.4-3 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| gimp | source | bullseye | (not affected) | |||
| gimp | source | bookworm | (not affected) | |||
| gimp | source | trixie | (not affected) | |||
| gimp | source | (unstable) | 3.2.4-1 |
[trixie] - gimp <not-affected> (Vulnerable code not present)
[bookworm] - gimp <not-affected> (Vulnerable code not present)
[bullseye] - gimp <not-affected> (Vulnerable code not present)
https://gitlab.gnome.org/GNOME/gimp/-/work_items/16151
Fixed by: https://gitlab.gnome.org/GNOME/gimp/-/commit/55256210f85b79b2ef72ea2bc6c84b52cb5ff335 (GIMP_3_2_4)