CVE-2026-58380
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
An off-by-one error was found in GIMP's PNM file format parser in the pnmscanner_gettoken() function. When parsing a crafted PNM file, a null terminator is written one byte past the end of a stack buffer, leading to memory corruption.
Risk Assessment
This vulnerability could allow an attacker to cause denial of service or potentially achieve arbitrary code execution, posing a serious risk to systems using GIMP for image processing.
Recommendation
Update GIMP to the latest patched version immediately. Until then, avoid opening untrusted PNM files.
Original NVD description (English source)
A flaw was found in GIMP's PNM file format parser. When parsing a specially crafted PNM file, the pnmscanner_gettoken() function writes a null terminator one byte past the end of a stack-allocated buffer due to an off-by-one error in the loop boundary check. This could lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.