CVE-2026-18300: 
NixOS vulnerability analysis and mitigation

CVE-2026-18300 is an integer overflow vulnerability in GIMP's HDR file parsing that allows remote attackers to execute arbitrary code on affected installations. The flaw was reported to the vendor on 2026-04-17, with coordinated public disclosure on 2026-07-29 via ZDI advisory ZDI-26-453, and formally published to NVD on 2026-08-20. The confirmed affected version is GIMP 3.2.2; the underlying flaw resides in the GEGL library used by GIMP. It carries a CVSS v3.0 base score of 7.8 (High) (ZDI Advisory, Github Advisory).

The vulnerability is classified as CWE-190 (Integer Overflow or Wraparound) and exists within GIMP's HDR file parsing code, specifically in the GEGL image processing library. When parsing a maliciously crafted HDR file, user-supplied data is not properly validated before being used in a calculation that determines buffer size; the resulting integer overflow causes an undersized buffer to be allocated. An attacker can then write beyond the allocated buffer boundary, enabling arbitrary code execution in the context of the GIMP process. Exploitation requires user interaction — the target must open a malicious HDR file or visit a page that triggers the file to be opened. The fix was committed to the GEGL repository (ZDI Advisory, Github Advisory, GEGL Commit).

Successful exploitation grants an attacker arbitrary code execution in the context of the user running GIMP, resulting in high confidentiality, integrity, and availability impact on the affected system. An attacker who achieves code execution can access files readable by the victim user, modify or delete data, and potentially use the compromised session as a foothold for lateral movement within the network. Because GIMP is commonly run with standard user privileges, the immediate blast radius is limited to the current user's context, though privilege escalation techniques could extend the impact further (ZDI Advisory, Github Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.332% (26th percentile), indicating a low near-term probability of exploitation. The vulnerability was discovered by researcher Michael Randrianantenaina and reported through the Zero Day Initiative program (ZDI Advisory).

1. Craft a malicious HDR file: Create a specially crafted HDR image file with manipulated header fields (e.g., image width or height values) designed to trigger an integer overflow during buffer size calculation in GEGL's HDR parser.
2. Deliver the file to the target: Distribute the malicious HDR file via email attachment, a web page that embeds or links to the file, a shared network drive, or social engineering (e.g., posing as a legitimate image asset).
3. Trigger file opening: Induce the target user to open the malicious HDR file in GIMP 3.2.2 (e.g., via double-click, drag-and-drop, or a browser plugin that invokes GIMP for HDR files).
4. Integer overflow triggers undersized allocation: GEGL's HDR parsing code processes the attacker-controlled dimension values, causing an integer overflow that results in a heap buffer smaller than the data to be written.
5. Heap corruption and code execution: Subsequent data written into the undersized buffer corrupts adjacent heap memory. With appropriate heap grooming, the attacker's payload overwrites control structures to redirect execution flow and achieve arbitrary code execution in the context of the GIMP process (ZDI Advisory, Github Advisory).

• Process: Unexpected child processes spawned by the GIMP process (e.g., sh, bash, cmd.exe, powershell, curl, wget) following the opening of an HDR file.
• File System: Newly created or modified files in the user's home directory, temp directories, or GIMP plugin directories shortly after opening an HDR file; unexpected scripts or executables dropped by the GIMP process.
• Network: Outbound network connections initiated by the GIMP process to external IP addresses, particularly after opening an HDR file from an untrusted source.
• Logs: Application crash logs or core dumps associated with GIMP/GEGL referencing HDR file parsing; OS-level memory corruption signals (e.g., SIGSEGV, heap corruption reports) tied to the GIMP process.

GIMP has issued a patch addressing this vulnerability via a commit to the GEGL library; users should update GIMP to a version that includes the fix referenced in the GEGL commit d3d262008299341c5b032b354021632ceadb2799 (GEGL Commit, Github Advisory). As an interim workaround, users should avoid opening HDR files from untrusted or unknown sources. Organizations can also consider running GIMP in a sandboxed environment (e.g., Flatpak, Snap, or a container) when processing files from untrusted origins to limit the impact of potential exploitation (ZDI Advisory).

The vulnerability was discovered by researcher Michael Randrianantenaina and responsibly disclosed through the Trend Micro Zero Day Initiative program, which coordinated the fix with the GIMP/GEGL maintainers before public release (ZDI Advisory). Red Hat has tracked the issue via Bugzilla and assigned it high severity for their product lines (Red Hat Bugzilla). No significant broader community or social media discussion has been identified at this time.