A flaw was found in the file-sgi plugin in GIMP. When processing an RLE-compressed SGI image, the plugin allocates memory for a row table. The image header dimensions (ysize and zsize) are read as 16-bit unsigned integers. If a crafted file sets both dimensions to their maximum value (65535), the multiplication ysize * zsize overflows the standard 32-bit int boundary before being passed to calloc. This integer overflow issue results in undefined behavior, aborting the plugin and causing a denial of service.

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1787057425 advisory.

  - A flaw was found in the file-sgi plugin in GIMP. When processing an RLE-compressed SGI image, the plugin     allocates memory for a row table. The image header dimensions (ysize and zsize) are read as 16-bit     unsigned integers. If a crafted file sets both dimensions to their maximum value (65535), the     multiplication ysize * zsize overflows the standard 32-bit int boundary before being passed to calloc.
    This integer overflow issue results in undefined behavior, aborting the plugin and causing a denial of     service. (CVE-2026-66757)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787058577 advisory.

  - A flaw was found in the file-sgi plugin in GIMP. When processing an RLE-compressed SGI image, the plugin     allocates memory for a row table. The image header dimensions (ysize and zsize) are read as 16-bit     unsigned integers. If a crafted file sets both dimensions to their maximum value (65535), the     multiplication ysize * zsize overflows the standard 32-bit int boundary before being passed to calloc.
    This integer overflow issue results in undefined behavior, aborting the plugin and causing a denial of     service. (CVE-2026-66757)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787058577 advisory.

  - A flaw was found in the file-sgi plugin in GIMP. When processing an RLE-compressed SGI image, the plugin     allocates memory for a row table. The image header dimensions (ysize and zsize) are read as 16-bit     unsigned integers. If a crafted file sets both dimensions to their maximum value (65535), the     multiplication ysize * zsize overflows the standard 32-bit int boundary before being passed to calloc.
    This integer overflow issue results in undefined behavior, aborting the plugin and causing a denial of     service. (CVE-2026-66757)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4309-1 advisory.

    Security issues fixed:

    - CVE-2026-59088: denial of service via signed integer overflow in FLI file processing (bsc#1274837).
    - CVE-2026-59090: arbitrary code execution in PSD plugin due to unsigned underflow (bsc#1274840).
    - CVE-2026-66757: signed integer overflow in `file-sgi` causes the plugin to crash when RLE-compressed SGI     images are       processed (bsc#1273151).
    - CVE-2026-78465: 32-bit integer overflow in PCX image memory calculations can cause undersized heap     allocations       (bsc#1277378).
    - CVE-2026-80101: independent header field validation in the XWD loader can cause heap out-of-bounds reads       (bsc#1276911).

    Non security issues fixed:

    - RLE-compressed SGI files are written with a bad offset table and 57 of 144 scanlines fail to decode, on     the patched       and the released build alike (bsc#1279838).
    - XWD bytes-per-line guard can never fire, and load_xwd_f1_d24_b1() still allocates the unchecked header     field       (bsc#1279839).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21839-1 advisory.

    Changes in gimp:

    - CVE-2026-66757: Fixed signed integer overflow in `file-sgi` causes the plugin to crash when RLE-     compressed SGI images are processed (bsc#1279838).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21733-1 advisory.

    Changes in gimp:

    - Update CVE-2026-66757 patch. The original patch wasn't allocating enough bytes.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of gimp installed on the remote host is prior to 2.8.22-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2GIMP-2026-018 advisory.

    A flaw was found in the file-sgi plugin in GIMP. When processing an RLE-compressed SGI image, the plugin     allocates memory for a row table. The image header dimensions (ysize and zsize) are read as 16-bit     unsigned integers. If a crafted file sets both dimensions to their maximum value (65535), the     multiplication ysize * zsize overflows the standard 32-bit int boundary before being passed to calloc.
    This integer overflow issue results in undefined behavior, aborting the plugin and causing a denial of     service. (CVE-2026-66757)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21521-1 advisory.

    Changes in gimp:

    - CVE-2026-66757: signed integer overflow in `file-sgi` causes the plugin to crash when RLE-compressed SGI     images are processed (bsc#1273151)
    - CVE-2026-66758: integer overflow in `file-fits` plugin causes a heap-based buffer overflow when crafted     FITS images are processed (bsc#1273152)
    - CVE-2026-66759: out-of-bounds read in `file-icns` plugin causes information disclosure or crash when     crafted ICNS images are processed (bsc#1273153)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in the file-sgi plugin in GIMP. When processing an RLE-compressed SGI image, the plugin     allocates memory for a row table. The image header dimensions (ysize and zsize) are read as 16-bit     unsigned integers. If a crafted file sets both dimensions to their maximum value (65535), the     multiplication ysize * zsize overflows the standard 32-bit int boundary before being passed to calloc.
    This integer overflow issue results in undefined behavior, aborting the plugin and causing a denial of     service. (CVE-2026-66757)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
352496	AlmaLinux 9.2 [TuxCare] Security Update: gimp / gimp-devel / gimp-devel-tools / gimp-libs (ALMALINUX9.2:CLSA-2026:1787057425)	Nessus	Alma Linux Local Security Checks	Local	medium
352007	AlmaLinux 9.6 [TuxCare] Security Update: gimp / gimp-devel / gimp-devel-tools / gimp-libs (ALMALINUX9.6:CLSA-2026:1787058577)	Nessus	Alma Linux Local Security Checks	Local	medium
351948	Rocky Linux 9.6 [TuxCare] Security Update: gimp / gimp-devel / gimp-devel-tools / gimp-libs (ALMALINUX9.6:CLSA-2026:1787058577)	Nessus	Rocky Linux Local Security Checks	Local	medium
349606	SUSE SLED15: gimp / gimp-devel / gimp-lang / gimp-plugin-aa / libgimp-2_0-0 / etc (SUSE-SU-2026:4309-1)	Nessus	SuSE Local Security Checks	Local	critical
346188	openSUSE 16: gimp / gimp-devel / gimp-extension-goat-excercises / gimp-lang / etc (openSUSE-SU-2026:21839-1)	Nessus	SuSE Local Security Checks	Local	medium
342587	openSUSE 16: gimp / gimp-devel / gimp-extension-goat-excercises / gimp-lang / etc (openSUSE-SU-2026:21733-1)	Nessus	SuSE Local Security Checks	Local	medium
337241	Amazon Linux 2 : gimp, --advisory ALAS2GIMP-2026-018 (ALASGIMP-2026-018)	Nessus	Amazon Linux Local Security Checks	Local	medium
332104	openSUSE 16: gimp / gimp-devel / gimp-extension-goat-excercises / gimp-lang / etc (openSUSE-SU-2026:21521-1)	Nessus	SuSE Local Security Checks	Local	high
330240	Linux Distros Unpatched Vulnerability : CVE-2026-66757	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-66757

medium

Tenable Plugins

medium

medium

medium

critical

medium

medium

medium

high

medium