CVE-2026-2044: 
NixOS vulnerability analysis and mitigation

CVE-2026-2044 is a remote code execution vulnerability in GIMP caused by the use of uninitialized memory during PGM file parsing. It affects GIMP version 3.0.6 and was reported to the vendor on November 11, 2025, with coordinated public disclosure on February 19, 2026. The vulnerability was discovered and reported anonymously through the Zero Day Initiative (ZDI-26-118). It carries a CVSS v3.0 base score of 7.8 (High) (ZDI Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-908 (Use of Uninitialized Resource): GIMP's PGM file parser accesses memory before it has been properly initialized, leading to undefined behavior that an attacker can control to redirect execution flow. The attack vector is local (the file must be opened by the target user), with low attack complexity and no privileges required, but user interaction is necessary — the victim must open a maliciously crafted PGM image file or visit a page that triggers its loading. The fix is documented in the official GIMP repository merge request commit 112a5e038f0646eae5ae314988ec074433d2b365 (ZDI Advisory, GIMP MR).

Successful exploitation allows an attacker to execute arbitrary code in the context of the user running GIMP, resulting in high confidentiality, integrity, and availability impacts on the affected workstation. An attacker who achieves code execution could access sensitive files, install malware, or use the compromised session as a foothold for lateral movement within a network. The scope is limited to the current process and user context, but on systems where GIMP is run with elevated privileges or in shared environments, the risk is amplified (ZDI Advisory, Red Hat Bugzilla).

A proof-of-concept exploit is referenced in the ZDI advisory (ZDI-26-118), but there is no evidence of active in-the-wild exploitation as of the time of disclosure. The vulnerability was internally tracked as ZDI-CAN-28158 and credited to an anonymous researcher. The EPSS score is approximately 0.063% (0.000630), indicating a low probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (ZDI Advisory, Feedly).

1. Craft a malicious PGM file: Create a specially crafted PGM (Portable Gray Map) image file that triggers the uninitialized memory access in GIMP's PGM parser. The payload is embedded in the file structure to control the uninitialized memory contents and redirect execution.
2. Deliver the file to the target: Distribute the malicious PGM file via email attachment, a malicious web page that auto-downloads or embeds the file, or a shared file system — any vector that causes the target user to open the file in GIMP.
3. Trigger user interaction: The target user must open the malicious PGM file in GIMP (e.g., via double-click, drag-and-drop, or a browser plugin that invokes GIMP for image handling).
4. Exploit uninitialized memory: When GIMP parses the PGM file, it accesses uninitialized memory. The attacker-controlled data in that memory region is used to hijack control flow (e.g., overwrite a function pointer or return address).
5. Achieve code execution: Arbitrary code executes in the context of the GIMP process, running with the privileges of the logged-in user, enabling payload delivery such as a reverse shell, credential harvesting, or dropper installation (ZDI Advisory).

• File System: Unexpected PGM files in download directories, temporary folders, or email attachment staging areas; new or modified files in the user's home directory or GIMP plugin directories shortly after opening a PGM file.
• Process: Unusual child processes spawned by the GIMP process (e.g., bash, sh, cmd.exe, powershell, curl, wget, python) that are not typical for image editing workflows.
• Network: Unexpected outbound network connections originating from the GIMP process to external IP addresses, particularly on non-standard ports, shortly after a PGM file is opened.
• Logs: System or application logs showing GIMP crashes or abnormal termination (segmentation faults) when opening PGM files, which may indicate failed exploitation attempts; audit logs showing file creation or execution events triggered by the GIMP process.

GIMP has issued a patch addressing this vulnerability, available via the official GIMP repository (merge request commit 112a5e038f0646eae5ae314988ec074433d2b365). Red Hat has released errata for affected RHEL versions: RHSA-2026:4173 (RHEL 9), RHSA-2026:5113 (RHEL 8), and multiple extended support errata (RHSA-2026:5388 through RHSA-2026:5437) for various RHEL 8/9 variants. Debian and AlmaLinux have also issued updates. Until patching is complete, users should avoid opening PGM files from untrusted sources and consider restricting GIMP's use in environments that process potentially malicious image files (Red Hat Bugzilla, ZDI Advisory).

Heise Online covered the vulnerability with an article titled "Security update: Malicious code attacks on GIMP possible," highlighting the risk to end users who open untrusted image files (Heise). The Hacker Wire shared the advisory on Mastodon and Bluesky shortly after public disclosure. Pro-Linux.de also published multiple security notices covering the GIMP vulnerabilities. Community reaction has been moderate, with the primary focus on patching workstations where GIMP is actively used, given the requirement for user interaction.