CVE-2026-2044

HighCVSS 8.8/10Last modified Jul 15, 2026

Description

GIMP PGM File Parsing Uninitialized Memory Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PGM files. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28158.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-908

Affected software

No affected versions have been published.

Timeline

Published
Feb 20, 2026
Last modified
Jul 15, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-204406.7In MAE, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicioCVE-2026-204416.7In MAE, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicioCVE-2026-204424.4In display, there is a possible system crash due to use after free. This could lead to local denial of service if a malicious actor has alreCVE-2026-204436.7In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actCVE-2026-204446.7In display, there is a possible memory corruption due to a missing bounds check. This could lead to local escalation of privilege if a malicCVE-2026-204454.4In MDDP, there is a possible system crash due to a race condition. This could lead to local denial of service if a malicious actor has alreaCVE-2026-204464.3In sec boot, there is a possible out of bounds write due to an integer overflow. This could lead to local denial of service, if an attacker CVE-2026-204476.7In geniezone, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege ifCVE-2026-204486.7In geniezone, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilegCVE-2026-204496.5In Modem, there is a possible system crash due to a heap buffer overflow. This could lead to remote denial of service, if a UE has connectedCVE-2026-20457.3GIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitraCVE-2026-204506.5In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connect
CVE-2026-2044: High severity, CVSS 8.8 | Vulnix