CVE-2026-42169: 
Alma Linux vulnerability analysis and mitigation

CVE-2026-42169 describes two heap-buffer-overflow vulnerabilities in GIMP (GNU Image Manipulation Program): one in the APNG (Animated PNG) file loader (file-png.c) triggered when the fcTL chunk width exceeds the IHDR width, and a second in the DDS plug-in's load_layer() function caused by a bits-per-pixel (BPP) mismatch. Both flaws can be triggered by opening a specially crafted image file, potentially leading to arbitrary code execution. The vulnerability was reported by Rakan Alotaibi (@hxteam) and publicly disclosed on August 4, 2026. It carries a CVSS v3.1 base score of 7.3 (High) (Red Hat CVE, GitHub Advisory). Red Hat Enterprise Linux 9 (GIMP packages prior to version 2:3.0.4-4.el9_8.9) is confirmed affected (Red Hat Errata).

The root cause is classified as CWE-131 (Incorrect Calculation of Buffer Size), where GIMP fails to properly validate image metadata before allocating heap buffers. In the APNG loader (file-png.c), when the fcTL chunk specifies a frame width larger than the IHDR (image header) width, pixel data is written beyond the end of the allocated heap buffer — a classic out-of-bounds write (CWE-787). In the DDS plug-in, a mismatch between the declared and actual bits-per-pixel value in load_layer() causes a similar heap overflow. Both attack vectors require local access and user interaction (the victim must open a malicious image file), making social engineering a likely delivery mechanism (Red Hat CVE, Red Hat Bugzilla).

Successful exploitation of either flaw can result in high confidentiality, integrity, and availability impact on the affected system, as rated by the CVSS score. An attacker who tricks a user into opening a malicious APNG or DDS image file could achieve arbitrary code execution in the context of the GIMP process, potentially enabling data theft, file system modification, or further compromise of the user's session. Red Hat notes that products shipping GIMP are affected when users are exposed to untrusted image files (Red Hat CVE).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the available data. The NVD SSVC assessment classifies exploitation as "none" and the vulnerability as not automatable, reflecting the requirement for user interaction. The EPSS score is approximately 0.13% (3rd percentile), indicating a low near-term exploitation probability (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection plugins are available from Tenable Nessus (IDs: 331875, 332755, 332980) and Qualys (ID: 6600267).

1. Craft a malicious image file: Create a specially crafted APNG file where the fcTL chunk's width field is set to a value exceeding the IHDR width, or craft a DDS file with a mismatched BPP value in its header to trigger the load_layer() overflow.
2. Deliver the file to the target: Use social engineering (e.g., email attachment, file sharing, or a malicious download link) to deliver the crafted .apng or .dds file to a user running a vulnerable version of GIMP.
3. Induce the victim to open the file: Convince the target user to open the malicious image in GIMP. The vulnerability is triggered automatically during the file parsing/loading phase without further user interaction beyond opening the file.
4. Trigger heap overflow: GIMP's APNG loader or DDS plug-in writes pixel data past the end of the allocated heap buffer, corrupting adjacent heap memory.
5. Achieve code execution: With a carefully crafted payload, an attacker may control the overwritten heap data to redirect execution flow, potentially spawning a shell or executing arbitrary commands in the context of the GIMP process (Red Hat CVE, Red Hat Bugzilla).

• Process: GIMP process (gimp, gimp-2.10, or gimp-3.0) crashing unexpectedly or generating core dumps after opening an image file; unusual child processes spawned from the GIMP process (e.g., shells or network utilities).
• File System: Presence of unexpected or malformed .apng or .dds files in user download directories or temporary folders; core dump files (core.*) in the user's home or working directory associated with the GIMP process.
• Logs: System logs (e.g., /var/log/messages, journalctl) showing segmentation faults or heap corruption errors from the gimp process; application crash reports referencing file-png.c or the DDS plug-in's load_layer() function.

Red Hat has released a patched package for Red Hat Enterprise Linux 9 via security advisory RHSA-2026:50817 (issued August 5, 2026). The fixed package version is gimp-3.0.4-4.el9_8.9 for x86_64, ppc64le, and aarch64 architectures. Red Hat notes that no practical configuration-based mitigation is available; upgrading to the patched package is the recommended remediation. Users should avoid opening untrusted APNG or DDS image files in GIMP until the patch is applied (Red Hat Errata, Red Hat CVE).

Red Hat credited Rakan Alotaibi (@hxteam) for discovering and reporting the vulnerability, and rated the security impact as "Important" in their advisory (Red Hat Errata). The vulnerability was noted by RedPacketSecurity on Mastodon shortly after disclosure. German Linux security outlet pro-linux.de covered the issue as part of broader GIMP security fixes. No significant independent researcher commentary or widespread community debate has been identified beyond standard vulnerability tracking and advisory coverage.