CVE-2026-66759: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-66759 is an out-of-bounds read vulnerability in the file-icns plugin of GIMP, affecting versions 2.99.14 and newer. When processing ICNS image files, the plugin fails to verify buffer boundaries while applying a decompressed mask, allowing a crafted truncated mask resource to trigger reads past the allocated buffer. This can result in heap memory disclosure or a denial-of-service crash. It was published on July 27, 2026, and carries a CVSS v3.1 base score of 7.1 (High) (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-125 (Out-of-bounds Read). Within the icns_decompress function of GIMP's file-icns plugin, the code reads from a mask data buffer while applying a decompressed mask during ICNS image processing, but does not check whether the read cursor has exceeded the allocated resource size. If an attacker supplies a crafted ICNS file with a truncated mask resource, the function continues reading beyond the buffer boundary. The leaked memory contents are exposed as alpha channel pixel values in the resulting image, or, if unmapped memory is accessed, the process crashes. Exploitation requires local access and user interaction (i.e., a victim must open the malicious file) (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation can lead to two distinct outcomes: information disclosure of heap memory contents (leaked as alpha channel pixel values in the processed image) or a denial-of-service crash if unmapped memory is accessed. The confidentiality impact is rated High, as heap contents — which may include sensitive in-memory data — can be exposed to an attacker who controls the crafted ICNS file and can retrieve the processed output. Integrity is not affected, and the attack scope is limited to the GIMP process itself (Red Hat CVE, Red Hat Bugzilla).

1. Craft a malicious ICNS file: Create an ICNS image file containing a mask resource that is intentionally truncated — shorter than the size declared in the resource header — so that the icns_decompress function will attempt to read beyond the allocated buffer.
2. Deliver the file to the target: Use social engineering, a malicious download link, or a shared file system to get the victim to open the crafted .icns file in GIMP (version 2.99.14 or newer).
3. Trigger the out-of-bounds read: When GIMP's file-icns plugin processes the file, the icns_decompress function reads past the end of the mask data buffer without bounds checking.
4. Extract leaked heap data: If the goal is information disclosure, retrieve the resulting image's alpha channel pixel values, which encode leaked heap memory contents. If the goal is denial of service, the process will crash upon accessing unmapped memory (Red Hat Bugzilla).

• File System: Presence of unexpected or externally sourced .icns files in user download directories or shared folders.
• Process: GIMP process (gimp, gimp-2.10, or similar) crashing unexpectedly or producing core dump files after opening an ICNS image.
• Logs: Application crash logs or core dumps referencing file-icns plugin or icns_decompress function in stack traces.
• Output Artifacts: Exported images from GIMP with anomalous alpha channel data that does not correspond to the expected image content, potentially containing heap memory artifacts.

No specific patched GIMP version has been publicly announced as of the disclosure date; the vulnerability is listed as affecting GIMP 2.99.14 and newer, with the Red Hat Bugzilla bug status marked as NEW. Users should avoid opening untrusted or unknown .icns files in GIMP until a patch is available. Organizations should monitor for updates from the GIMP project and Red Hat, and apply patches promptly upon release. As a workaround, restrict access to GIMP on systems where untrusted image files may be processed (Red Hat Bugzilla, Red Hat CVE).