CVE-2026-6695

Name of the Vulnerable Software and Affected Versions GIMP (affected versions not specified)

Description A heap-based out-of-bounds write exists in the decode lzss() function of the PAA (Paint Shop Pro Array) file format plugin. A remote attacker can exploit this by tricking a user into opening a specially crafted PAA image file, allowing data to be written beyond the intended memory buffer. This can result in heap metadata corruption and potentially enable the execution of arbitrary code on the system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.