Description

A flaw was found in the file-pix (ESM) plugin in GIMP. When processing a specially crafted PIX image file, the plugin allocates a Variable-Length Array (VLA) on the stack without proper bounds checking, causing an unbounded stack allocation followed by a 21-byte stack over-read. This can result in a denial of service due to stack exhaustion and a limited information disclosure of stack memory contents into an intermediate file.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-24T18:17:34.807Z",
  "pubdate": "2026-08-24T18:17:34.807Z",
  "executiveSummary": "A vulnerability has been identified in the file-pix (ESM) plugin within GIMP, specifically involving an improper memory allocation mechanism when parsing image files.\nThe flaw stems from the insecure usage of a Variable-Length Array (VLA) allocated directly on the stack without adequate bounds checking.\nAn attacker capable of delivering a specially crafted PIX image file to a victim can trigger this vulnerability, leading to a denial of service through stack exhaustion or limited information disclosure via stack memory leakage into an intermediate file.\nThe impact is primarily localized to application availability and low-severity data confidentiality loss, as stack memory contents are exposed.\nNo specific authentication or network exposure requirements are inherently mandated by the flaw itself, other than the prerequisite of processing a malicious file within the affected GIMP plugin.\nRisk implications include potential application crashes during routine image processing tasks and unauthorized extraction of residual stack data.",
  "technicalDetails": "The root cause of the vulnerability resides within the file-pix (ESM) plugin of GIMP during the ingestion and parsing routine of PIX image files.\nWhen processing a crafted input file containing malicious header or dimension values, the plugin dynamically allocates a Variable-Length Array (VLA) on the call stack.\nBecause the plugin fails to perform rigorous validation or bounds checking on the untrusted size parameters derived from the PIX file, the allocation size can be excessively large.\nThis unbounded stack allocation directly triggers a stack overflow condition, manifesting as stack exhaustion that terminates the application, resulting in a denial of service.\nFurthermore, the faulty parsing logic results in a 21-byte stack over-read.\nThe step-by-step attack flow begins when a user opens or processes the malicious PIX image using GIMP.\nThe file-pix plugin reads the crafted dimensions from the file without validation.\nThe vulnerable function allocates the unbounded VLA on the stack, consuming available stack memory.\nSubsequent read operations perform an over-read, capturing 21 bytes of adjacent stack memory contents.\nFinally, the leaked stack memory contents are inadvertently written into an intermediate file generated during the processing workflow, achieving limited information disclosure.\nThe vulnerable component is explicitly the file-pix (ESM) plugin.\nExploitation requires local file processing interaction, wherein a victim must open the malicious PIX file using the vulnerable GIMP installation."
}