CVE-2026-78475

Name of the Vulnerable Software and Affected Versions GIMP (affected versions not specified)

Description A flaw exists in the file-pix (ESM) plugin. When processing a specially crafted PIX image file, the plugin allocates a Variable-Length Array (VLA)—an array whose size is determined at runtime—on the stack without proper bounds checking. This leads to an unbounded stack allocation and a subsequent 21-byte stack over-read, where the system reads data beyond the intended buffer boundary. This issue can result in a denial of service due to stack exhaustion or a limited disclosure of stack memory contents into an intermediate file.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.