A flaw was found in the file-sgi plugin in GIMP. When processing an RLE-compressed SGI image, the plugin allocates memory for a row table. The image header dimensions (ysize and zsize) are read as 16-bit unsigned integers. If a crafted file sets both dimensions to their maximum value (65535), the multiplication ysize * zsize overflows the standard 32-bit int boundary before being passed to calloc. This integer overflow issue results in undefined behavior, aborting the plugin and causing a denial of service.

The version of gimp installed on the remote host is prior to 2.8.22-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2GIMP-2026-018 advisory.

    A flaw was found in the file-sgi plugin in GIMP. When processing an RLE-compressed SGI image, the plugin     allocates memory for a row table. The image header dimensions (ysize and zsize) are read as 16-bit     unsigned integers. If a crafted file sets both dimensions to their maximum value (65535), the     multiplication ysize * zsize overflows the standard 32-bit int boundary before being passed to calloc.
    This integer overflow issue results in undefined behavior, aborting the plugin and causing a denial of     service. (CVE-2026-66757)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21521-1 advisory.

    Changes in gimp:

    - CVE-2026-66757: signed integer overflow in `file-sgi` causes the plugin to crash when RLE-compressed SGI     images are processed (bsc#1273151)
    - CVE-2026-66758: integer overflow in `file-fits` plugin causes a heap-based buffer overflow when crafted     FITS images are processed (bsc#1273152)
    - CVE-2026-66759: out-of-bounds read in `file-icns` plugin causes information disclosure or crash when     crafted ICNS images are processed (bsc#1273153)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in the file-sgi plugin in GIMP. When processing an RLE-compressed SGI image, the plugin     allocates memory for a row table. The image header dimensions (ysize and zsize) are read as 16-bit     unsigned integers. If a crafted file sets both dimensions to their maximum value (65535), the     multiplication ysize * zsize overflows the standard 32-bit int boundary before being passed to calloc.
    This integer overflow issue results in undefined behavior, aborting the plugin and causing a denial of     service. (CVE-2026-66757)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
337241	Amazon Linux 2 : gimp, --advisory ALAS2GIMP-2026-018 (ALASGIMP-2026-018)	Nessus	Amazon Linux Local Security Checks	Local	medium
332104	openSUSE 16: gimp / gimp-devel / gimp-extension-goat-excercises / gimp-lang / etc (openSUSE-SU-2026:21521-1)	Nessus	SuSE Local Security Checks	Local	high
330240	Linux Distros Unpatched Vulnerability : CVE-2026-66757	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-66757

medium

Tenable Plugins

medium

high

medium