CVE-2026-2045: 
NixOS vulnerability analysis and mitigation

CVE-2026-2045 is an out-of-bounds write vulnerability in GIMP's XWD file parser that allows remote attackers to execute arbitrary code on affected installations. The flaw was reported to the vendor on November 11, 2025, and publicly disclosed on February 19, 2026, via a coordinated Zero Day Initiative advisory. It affects GIMP version 3.0.6 and was assigned a CVSS v3.0 base score of 7.8 (High) (ZDI Advisory, Red Hat Bugzilla).

The vulnerability is classified as CWE-787 (Out-of-bounds Write) and stems from insufficient validation of user-supplied data during XWD file parsing in GIMP. When processing a maliciously crafted XWD image file, the parser writes data past the end of an allocated heap buffer, which can be leveraged to achieve arbitrary code execution in the context of the GIMP process. Exploitation requires user interaction — the target must open a malicious XWD file or visit a malicious page that triggers the file to be opened. The fix is available in the upstream GIMP commit at GitLab (ZDI Advisory, GNOME GitLab).

Successful exploitation results in high confidentiality, integrity, and availability impact — an attacker can execute arbitrary code in the context of the GIMP process, potentially accessing sensitive files readable by the user, modifying data, or crashing the application. Because the attack vector is local and requires user interaction (opening a malicious file), the blast radius is limited to the privileges of the targeted user account rather than system-wide compromise. However, in environments where GIMP is used to process untrusted image files (e.g., design workflows, automated pipelines), the risk of exploitation is elevated (ZDI Advisory, Red Hat Bugzilla).

A proof-of-concept exploit is referenced in the Zero Day Initiative advisory (ZDI-26-119), credited to researcher Michael Randrianantenaina. As of the time of disclosure, there is no evidence of active in-the-wild exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.063% (0.000630), indicating a low probability of exploitation in the near term (ZDI Advisory).

1. Craft a malicious XWD file: Create a specially crafted XWD (X Window Dump) image file that contains malformed header or pixel data designed to trigger an out-of-bounds write when parsed by GIMP's XWD file handler.
2. Deliver the payload: Distribute the malicious XWD file via phishing email, a malicious webpage with a download link, or by placing it in a shared directory accessible to the target user.
3. Induce user interaction: Convince the target to open the malicious XWD file in GIMP (e.g., via social engineering, file association tricks, or embedding in a workflow that auto-processes image files).
4. Trigger the buffer overflow: When GIMP parses the malformed XWD file, the lack of proper input validation causes a write past the end of an allocated buffer (heap overflow), corrupting adjacent memory.
5. Achieve code execution: By controlling the overwritten memory region (e.g., function pointers or heap metadata), the attacker redirects execution flow to attacker-controlled shellcode or a ROP chain, executing arbitrary code in the context of the GIMP process and the current user (ZDI Advisory, GNOME GitLab).

• File System: Presence of unexpected or suspicious .xwd files in download directories, temp folders, or shared drives; new or modified files in the user's home directory created around the time GIMP was opened.
• Process: Unusual child processes spawned by the GIMP process (e.g., /bin/sh, bash, curl, wget, python) shortly after opening an XWD file; GIMP process crashing unexpectedly (segmentation fault) when opening specific files.
• Logs: System logs (e.g., /var/log/syslog, journalctl) showing GIMP segfaults or abnormal termination; audit logs recording unexpected file access or network connections initiated by the GIMP process.
• Network: Outbound connections from the GIMP process to external IP addresses (GIMP does not normally initiate network connections during local file editing).

GIMP has issued a patch addressing this vulnerability; the fix is available in the upstream commit on GNOME GitLab. Red Hat has released errata for multiple RHEL versions: RHSA-2026:4173 (RHEL 9), RHSA-2026:5113 (RHEL 8), and several Extended Update Support and SAP Solutions errata (RHSA-2026:5388 through RHSA-2026:5437). Debian, AlmaLinux, Rocky Linux, and Amazon Linux 2 have also issued updated packages. As an interim workaround, users should avoid opening XWD files from untrusted sources, and administrators should consider sandboxing GIMP or restricting its use until patched packages are deployed (Red Hat Bugzilla, GNOME GitLab).

Heise Online published a news article titled "Security update: Malicious code attacks on GIMP possible" covering the vulnerability and the need to update (Heise Online). The vulnerability was noted on social media platforms including Mastodon and Bluesky by security news accounts such as @thehackerwire. Community reaction has been moderate, consistent with a file-parsing vulnerability requiring user interaction, with no reports of widespread alarm or active exploitation campaigns.