CVE-2026-90947

Published: Sep 14, 2026Modified: Oct 19, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: secalert@redhat.com (Secondary)

Description

A flaw was found in GIMP. When processing a specially crafted lighting preset file, the Lighting Effects filter does not properly validate the number of light sources. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to open a malicious preset file, potentially causing a crash or enabling arbitrary code execution.

Related CWEs

CWE-787

Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

References (5)

https://access.redhat.com/errata/RHSA-2026:75575

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2026:84744

Source: secalert@redhat.com

https://access.redhat.com/security/cve/CVE-2026-90947

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2533005

Source: secalert@redhat.com

https://gitlab.gnome.org/GNOME/gimp/-/work_items/16682

Source: secalert@redhat.com

Timeline

No history available yet.