Description

A flaw was found in GIMP. When processing a specially crafted lighting preset file, the Lighting Effects filter does not properly validate the number of light sources. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to open a malicious preset file, potentially causing a crash or enabling arbitrary code execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-14T16:17:41.860Z",
  "pubdate": "2026-09-14T16:17:41.860Z",
  "executiveSummary": "A critical out-of-bounds (OOB) write vulnerability has been identified within the GIMP Lighting Effects filter.\nThe flaw originates from insufficient validation of light source parameters defined in specially crafted lighting preset files.\nSuccessful exploitation allows an attacker to corrupt memory by providing a malicious preset file, which, if opened by a user, could lead to a process crash or potentially facilitate arbitrary code execution.\nThe vulnerability affects GIMP's internal handling of preset configurations and relies on user interaction to trigger the parsing logic.\nThe risk implication is significant due to the potential for remote code execution, as the application processes external, untrusted input files.\nExploitation does not require prior authentication but necessitates a social engineering component where a user is convinced to open a malformed preset file.",
  "technicalDetails": "The vulnerability exists in the GIMP Lighting Effects filter, which is responsible for parsing lighting preset files. The root cause is a failure in the input validation logic when the filter processes the number of light sources defined in the preset file structure.\nWhen a user loads a malicious preset, the application reads the defined light source count without verifying if this value exceeds the allocated bounds of the internal data structures intended to store light effect parameters.\nBecause the application fails to perform bounds checking before writing these values to memory, the parser performs an out-of-bounds write operation. This allows an attacker to overwrite adjacent heap or stack memory locations with controlled or semi-controlled data.\nThe attack flow proceeds as follows: First, the attacker creates a malformed lighting preset file containing an abnormally high or specifically crafted light source count value. Second, the attacker distributes this file to a target user. Third, upon opening the file in GIMP, the Lighting Effects filter parses the file header and proceeds to initialize memory buffers for light sources based on the attacker-supplied value. Fourth, the filter writes parameters into these buffers, resulting in memory corruption as the write operation crosses intended boundaries.\nThe memory corruption can be leveraged to alter function pointers, return addresses, or application data objects. If the memory overwrite is precise, an attacker may achieve arbitrary code execution by diverting control flow to a malicious payload embedded within the preset or staged elsewhere in memory.\nAs GIMP processes these files locally, there is no network exposure requirement; however, the vulnerability is exposed via the standard file-import mechanisms. No authentication is required to trigger the flaw, as the parsing logic executes upon the user loading the preset file into the application.\nPost-exploitation, the impact ranges from a denial-of-service via application crash due to memory corruption errors to full system compromise if code execution is successfully achieved within the context of the user running GIMP."
}