CVE-2026-2050

HighCVSS 7.8/10Last modified Sep 9, 2026

Description

GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of HDR files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28266.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122CWE-131

Affected software

No affected versions have been published.

Timeline

Published
Jun 24, 2026
Last modified
Sep 9, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-205005.5In Modem, there is a possible system crash due to improper input validation. This could lead to local denial of service with User execution CVE-2026-205018.4In vdec, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no addCVE-2026-205028.4In vdec, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no addCVE-2026-205035.3In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connectedCVE-2026-205045.3In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connectedCVE-2026-205066.7In Audio HAL, there is a possible escalation of privilege due to use after free. This could lead to local escalation of privilege if a malicCVE-2026-205076.7In Audio HAL, there is a possible escalation of privilege due to use after free. This could lead to local escalation of privilege if a malicCVE-2026-205086.7In Power HAL, there is a possible escalation of privilege due to type confusion. This could lead to local escalation of privilege if a malicCVE-2026-205096.7In Power HAL, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a mCVE-2026-205106.7In camera middleware, there is a possible escalation of privilege due to double free. This could lead to local escalation of privilege if a CVE-2026-205116.7In SurfaceFlinger, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a maliciCVE-2026-205126.7In Audio HAL, there is a possible escalation of privilege due to improper input validation. This could lead to local escalation of privilege