CVE-2026-66758

Summary

A flaw was found in the file-fits plugin in GIMP. When processing a FITS image file, the plugin calculates memory allocation sizes using signed 32-bit integers for width and height. If a crafted file sets both values to large values, their product exceeds 2^31 and overflows, resulting in an undersized heap-based buffer allocation. This integer overflow issue results in a heap-based buffer overflow when cfitsio subsequently writes a full row of pixels in the buffer, causing memory corruption, potentially leading to arbitrary code execution or a denial of service.

Affected Software

VendorProductVersion RangeStatus
Red HatRed Hat Enterprise Linux 88100020260824165450.4c9c024f < *unaffected
Red HatRed Hat Enterprise Linux 92:3.0.4-4.el9_8.9 < *unaffected
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support2:2.99.8-4.el9_6.20 < *unaffected

Weaknesses

  • CWE-190: Integer Overflow or Wraparound

Workarounds

To mitigate this vulnerability, do not open FITS files from untrusted sources with GIMP.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References