CVE-2026-90948

Name of the Vulnerable Software and Affected Versions GIMP (affected versions not specified) Red Hat Enterprise Linux (affected versions not specified)

Description A flaw exists in the ICO file loader. When processing an ICO file that contains an embedded PNG image, an integer overflow can occur during the calculation of the required buffer size. This results in the allocation of an undersized buffer, leading to a heap-based buffer overflow when the decoded pixel data is written. A remote attacker could exploit this by providing a specially crafted ICO file, which may result in a crash or arbitrary code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.