CVE-2026-6695

NameCVE-2026-6695
DescriptionA flaw was found in GIMP. A remote attacker could exploit this by tricking a user into opening a specially crafted PAA (Paint Shop Pro Array) image file. This vulnerability, a heap-based out-of-bounds write in the decode_lzss() function of the PAA file format plugin, allows data to be written beyond the intended memory buffer. This could lead to heap metadata corruption and potentially enable the attacker to execute arbitrary code on the affected system.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
gimp (PTS)bullseye2.10.22-4+deb11u2fixed
bullseye (security)2.10.22-4+deb11u8fixed
bookworm, bookworm (security)2.10.34-1+deb12u10fixed
trixie3.0.4-3+deb13u9fixed
trixie (security)3.0.4-3+deb13u8fixed
forky, sid3.2.4-3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
gimpsourcebullseye(not affected)
gimpsourcebookworm(not affected)
gimpsourcetrixie(not affected)
gimpsource(unstable)3.2.4-1

Notes

[trixie] - gimp <not-affected> (Vulnerable code not present)
[bookworm] - gimp <not-affected> (Vulnerable code not present)
[bullseye] - gimp <not-affected> (Vulnerable code not present)
https://gitlab.gnome.org/GNOME/gimp/-/work_items/16151
Fixed by: https://gitlab.gnome.org/GNOME/gimp/-/commit/55256210f85b79b2ef72ea2bc6c84b52cb5ff335 (GIMP_3_2_4)

Search for package or bug name: Reporting problems