PatchTheCVECVE-2026-42169: A heap-buffer-overflow vulnerability exists in the APNG (Animated PNG) file loader of GIMP
CVE-2026-42169 is a high-severity flaw (CVSS 7.3) affecting enterprise linux, enterprise linux eus. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A heap-buffer-overflow vulnerability exists in the APNG (Animated PNG) file loader of GIMP. This flaw occurs when the `fcTL` width exceeds the `IHDR` width, leading to pixel data being written past the end of a heap allocation. Additionally, a heap-based buffer overflow exists in the DDS plug-in due to a BPP mismatch in the `load_layer()` function. Both vulnerabilities can be triggered by opening a specially crafted image file, potentially leadin
Why this priority
- High severity
- On your watchlist
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 7.3 (High) |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | Required |
| EPSS exploit chance | 0.1% (top 97%) |
| CISA exploited list | No |
| Weakness | CWE-131 |
| Published | 2026-08-04 |
| Last modified | 2026-10-12 |
Last updated 2026-10-12 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Advisories and coverage
Official advisories
- AlmaLinux Errata: [ALSA-2026:50817] Important: gimp security update 2026-08-06
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-42169?
enterprise linux: mitigate or apply the listed mitigation; enterprise linux eus: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2026-42169 being exploited?
CVE-2026-42169 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-42169 affect?
CVE-2026-42169 affects enterprise linux, enterprise linux eus. Severity is high (CVSS 7.3). A heap-buffer-overflow vulnerability exists in the APNG (Animated PNG) file loader of GIMP. This flaw occurs when the `fcTL` width exceeds the `IHDR` width, leading to pixel data being written past the end of a heap allocation. Additionally
How urgent is CVE-2026-42169?
Priority 31/100. High severity; On your watchlist
Related CVEs
- CVE-2026-34486 HIGH 7.5 EXPLOITED DOWNGRADE DOWNGRADE Apache Tomcat Missing Encryption of Sensitive Data Vulnerability
- CVE-2026-33845 HIGH 7.5 MITIGATE DOWNGRADE A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leadi
- CVE-2026-42010 HIGH 7.1 MITIGATE MITIGATE A flaw was found in gnutls
- CVE-2026-5704 MEDIUM 5.0 MITIGATE MITIGATE A flaw was found in tar
- CVE-2026-4948 MEDIUM 5.5 UPGRADE MITIGATE A flaw was found in firewalld