CVE-2026-66758: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-66758 is an integer overflow vulnerability in the file-fits plugin of GIMP that leads to a heap-based buffer overflow when processing crafted FITS image files. The flaw affects all versions of GIMP and was disclosed on July 27, 2026, with the CVE status currently listed as "Awaiting Analysis." Exploitation requires user interaction (opening a malicious FITS file) but no special privileges. It carries a CVSS v3.1 base score of 7.8 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is an integer overflow (CWE-190) in GIMP's file-fits plugin, where width and height values from a FITS image header are stored as signed 32-bit integers. When a crafted file supplies sufficiently large values for both dimensions, their product exceeds 2^31, wraps around, and causes an undersized heap buffer to be allocated. When the cfitsio library subsequently writes a full row of pixel data into this undersized buffer, an out-of-bounds write (CWE-787) occurs, resulting in heap memory corruption. The attack vector is local, requiring the victim to open a specially crafted FITS file, but no privileges are required beyond standard user access (Red Hat Bugzilla, Red Hat Advisory).

Successful exploitation can result in memory corruption leading to arbitrary code execution or a denial of service (application crash) in the context of the user running GIMP. All three security pillars are affected at a high level: confidentiality, integrity, and availability. Because GIMP typically runs with standard user privileges, the immediate blast radius is limited to the user's session, though code execution could enable further local privilege escalation or data exfiltration (Red Hat Bugzilla).

1. Craft a malicious FITS file: Create a FITS image file with crafted header values setting both NAXIS1 (width) and NAXIS2 (height) to large values such that their product exceeds 2^31 (e.g., both set to ~46341 or larger), triggering the integer overflow in the file-fits plugin's memory allocation calculation.
2. Deliver the file to the target: Use phishing, a malicious download link, or a compromised file-sharing service to deliver the crafted .fits file to a victim running a vulnerable version of GIMP.
3. Trigger the vulnerability: Convince the victim to open the crafted FITS file in GIMP. The file-fits plugin processes the header, performs the overflowing multiplication, and allocates an undersized heap buffer.
4. Heap buffer overflow: cfitsio writes a full row of pixel data into the undersized buffer, overwriting adjacent heap memory with attacker-controlled data.
5. Achieve code execution or crash: Depending on heap layout and exploit sophistication, the memory corruption may be leveraged to redirect execution flow (e.g., overwrite function pointers or metadata) to execute arbitrary code, or may simply crash the application (Red Hat Bugzilla).

• File System: Presence of unexpected .fits files in user download directories or temporary folders, particularly with unusually large declared image dimensions in their headers.
• Process: GIMP process (gimp, gimp-2.x) crashing with segmentation faults or heap corruption errors when opening FITS files; unexpected child processes spawned from GIMP.
• Logs: Application crash logs or core dumps referencing the file-fits plugin or cfitsio library; system logs showing GIMP terminating abnormally (e.g., SIGSEGV, SIGABRT) shortly after opening a FITS file.

As of the disclosure date, no patched GIMP version has been publicly announced and the CVE remains "Awaiting Analysis." Users should avoid opening FITS image files from untrusted sources in GIMP until a patch is available. As a workaround, administrators can restrict or disable the file-fits plugin by removing or renaming the plugin binary in the GIMP plugin directory. Monitor the Red Hat Security Advisory and GNOME GitLab issue tracker for patch availability (Red Hat Advisory, Red Hat Bugzilla).

The vulnerability was reported via Red Hat's OSIDB system and tracked in Red Hat Bugzilla, indicating it was identified through Red Hat's internal security processes. The GNOME GitLab issue tracker also has a corresponding issue (#16528). As of disclosure, no notable public researcher commentary, vendor statements beyond the initial report, or significant social media discussion has been observed.