CVE-2026-2272: 
NixOS vulnerability analysis and mitigation

CVE-2026-2272 is an integer overflow vulnerability in GIMP's ICO image file parser that can lead to buffer overflow and memory corruption, resulting in application-level denial of service. The flaw exists in the ico_read_info and ico_read_icon functions, where a 32-bit integer size calculation for image buffers can wrap around, allowing oversized image headers to bypass security checks. It affects GIMP 3.0.6 and GIMP packages on Red Hat Enterprise Linux 6.0, 7.0, 8.0, and 9.0. The vulnerability was first reported on February 10, 2026, and has a CVSS v3.1 base score of 6.5 (Medium) (Red Hat CVE, Red Hat Bugzilla).

The root cause is an integer overflow or wraparound (CWE-190) in GIMP's ICO file handling code. Specifically, ico_read_info sizes the image buffer based on ICO directory entry dimensions, while ico_read_icon trusts the BITMAPINFOHEADER width/height values for decoding — creating a mismatch when header dimensions are larger than the directory entry. The size guard expression data.width * data.height * 2 > maxsize is evaluated as a 32-bit guint32, which can wrap around for large values, allowing oversized headers to pass the check. Decode loops then use the large width/height values and write past the allocated buffer; additionally, ico_alloc_map uses gint length math that can overflow for xor_map/and_map allocations when dimensions are huge. Exploitation requires user interaction — a victim must open a specially crafted ICO file — but no privileges are required (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation causes memory corruption via a heap buffer overflow, which can crash the GIMP application, resulting in an application-level denial of service. Confidentiality and integrity are not directly impacted based on current analysis — the primary consequence is availability loss. The attack vector is network-based in the sense that a malicious ICO file can be delivered remotely, but local user interaction (opening the file) is required to trigger the vulnerability (Red Hat CVE, Red Hat Bugzilla).

A proof-of-concept exploit is publicly available, referenced via the Red Hat Bugzilla report and the GNOME GitLab issue tracker, demonstrating the integer overflow with a crafted ICO file using Python's struct.pack. There is no evidence of active in-the-wild exploitation at this time, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.058% (0.000580), indicating a low probability of exploitation in the near term (Red Hat Bugzilla, GNOME GitLab).

1. Craft a malicious ICO file: Use a script (e.g., Python with struct.pack) to construct an ICO file with a directory entry specifying small dimensions but a BITMAPINFOHEADER with very large width/height values designed to trigger the 32-bit integer wraparound in the size guard check.
2. Deliver the file to the target: Host the malicious ICO file on a web server, send it via email, or distribute it through any channel that would lead the victim to open it with GIMP.
3. Trigger user interaction: Convince the target user to open the crafted ICO file in GIMP (e.g., via social engineering, a malicious download link, or embedding in a document).
4. Trigger the overflow: When GIMP processes the file, ico_read_info allocates a buffer based on the small directory entry dimensions, while ico_read_icon uses the large BITMAPINFOHEADER dimensions for decoding, causing the size guard data.width * data.height * 2 > maxsize to wrap around in 32-bit arithmetic and pass.
5. Achieve memory corruption/crash: Decode loops write past the allocated buffer using the large dimensions, corrupting heap memory and causing GIMP to crash (denial of service) (Red Hat Bugzilla).

• File System: Presence of unexpected or suspicious .ico files in download directories, temporary folders, or email attachments on systems running GIMP.
• Logs: Application crash logs or core dumps associated with the GIMP process (gimp, gimp-2.10, or gimp-3.0) following the opening of an ICO file; system logs showing GIMP process termination with segmentation fault or memory error signals.
• Process: Abnormal termination of the GIMP process (exit code indicating crash/signal) shortly after loading an ICO file; repeated GIMP crashes triggered by the same file.

Apply available security patches for GIMP as distributed through Red Hat's security advisories and downstream Linux distribution package managers (Debian, Amazon Linux 2, etc.). A patch was made available via Red Hat Bugzilla on February 10, 2026, and Debian security advisories (DSA-6139-1, DLA-4483-1) and Amazon Linux 2 (ALAS2GIMP-2026-011) have also issued updates. As a workaround, users should avoid opening ICO files from untrusted sources, and organizations should consider restricting ICO file handling in GIMP if not required for business operations (Red Hat Bugzilla, Red Hat CVE).

The vulnerability was tracked and reported by Red Hat's Product Security team via OSIDB and Bugzilla, with downstream distributions including Debian and Amazon Linux issuing their own advisories. Vulnerability scanners from Tenable (Nessus plugins 298498, 299380, 299978, 301256) and Qualys (detections 6274173, 761042) have added detection coverage. No significant public researcher commentary or social media discussion has been identified beyond standard vulnerability tracking and advisory publication.