CVE-2026-66759

Name of the Vulnerable Software and Affected Versions GIMP (affected versions not specified)

Description A flaw in the file-icns plugin occurs during ICNS image processing when applying a decompressed mask. The plugin fails to verify if the cursor exceeds the allocated resource size while reading from the mask data buffer. When processing a crafted file with a truncated mask resource, the icns decompress() function reads past the buffer bounds. This out-of-bounds read can lead to a denial of service via a crash if unmapped memory is accessed, or information disclosure where heap contents are leaked as alpha channel pixel values.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.