A flaw was found in the file-ico plugin in GIMP. When processing a specially crafted ICO image file, the plugin does not properly validate the used_clrs (palette count) parameter. This incorrect validation leads to improper memory bounds checking, resulting in a heap out-of-bounds read. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of heap memory contents.

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1788427757 advisory.

  - A flaw was found in the file-ico plugin in GIMP. When processing a specially crafted ICO image file, the     plugin does not properly validate the used_clrs (palette count) parameter. This incorrect validation leads     to improper memory bounds checking, resulting in a heap out-of-bounds read. This issue can result in an     application crash, leading to a denial of service or a limited information disclosure of heap memory     contents. (CVE-2026-82328)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1788429305 advisory.

  - A flaw was found in the file-ico plugin in GIMP. When processing a specially crafted ICO image file, the     plugin does not properly validate the used_clrs (palette count) parameter. This incorrect validation leads     to improper memory bounds checking, resulting in a heap out-of-bounds read. This issue can result in an     application crash, leading to a denial of service or a limited information disclosure of heap memory     contents. (CVE-2026-82328)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1788429305 advisory.

  - A flaw was found in the file-ico plugin in GIMP. When processing a specially crafted ICO image file, the     plugin does not properly validate the used_clrs (palette count) parameter. This incorrect validation leads     to improper memory bounds checking, resulting in a heap out-of-bounds read. This issue can result in an     application crash, leading to a denial of service or a limited information disclosure of heap memory     contents. (CVE-2026-82328)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6509 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6509-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     September 20, 2026                    https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : gimp     CVE ID         : CVE-2026-78465 CVE-2026-78475 CVE-2026-82328                      CVE-2026-90947 CVE-2026-90948 CVE-2026-92248

    Several vulnerabilities were discovered in GIMP, the GNU Image     Manipulation Program, which could result in denial of service     or potentially the execution of arbitrary code if malformed     PSD, light effects filter, ICO, PIX or PCX files are opened.

    For the stable distribution (trixie), these problems have been fixed in     version 3.0.4-3+deb13u11.

    We recommend that you upgrade your gimp packages.

    For the detailed security status of gimp please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/gimp

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of gimp installed on the remote host is prior to 2.8.22-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2GIMP-2026-020 advisory.

    GIMP PSD File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows     remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required     to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

    The specific flaw exists within the parsing of PSD files. The issue results from the lack of proper     validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An     attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-     CAN-29395. (CVE-2026-18301)

    GIMP TIF File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability     allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is     required to exploit this vulnerability in that the target must visit a malicious page or open a malicious     file.

    The specific flaw exists within the parsing of TIF files. The issue results from the lack of proper     validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker     can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29399.
    (CVE-2026-18303)

    GIMP TIF File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows     remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required     to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

    The specific flaw exists within the parsing of TIF files. The issue results from the lack of proper     validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An     attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-     CAN-29406. (CVE-2026-18305)

    A flaw was found in the file-xwd plugin in GIMP. When processing a specially crafted XWD image file, the     plugin validates the image width and bytes-per-line parameters independently rather than ensuring their     combined values are consistent with the allocated buffer size. This incorrect validation leads to improper     bounds checking, causing a heap out-of-bounds read. This issue can result in an application crash, leading     to a denial of service, or a limited information disclosure of heap memory contents into the produced     image. (CVE-2026-80101)

    A flaw was found in the file-ico plugin in GIMP. When processing a specially crafted ICO image file, the     plugin does not properly validate the used_clrs (palette count) parameter. This incorrect validation leads     to improper memory bounds checking, resulting in a heap out-of-bounds read. This issue can result in an     application crash, leading to a denial of service or a limited information disclosure of heap memory     contents. (CVE-2026-82328)

    A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image file, the     plugin does not properly validate the channel-count parameter. This incorrect validation leads to improper     memory bounds checking, resulting in both a heap out-of-bounds read and a stack out-of-bounds access. This     issue can result in an application crash, leading to a denial of service or a limited information     disclosure of memory contents. (CVE-2026-82343)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in the file-ico plugin in GIMP. When processing a specially crafted ICO image file, the     plugin does not properly validate the used_clrs (palette count) parameter. This incorrect validation leads     to improper memory bounds checking, resulting in a heap out-of-bounds read. This issue can result in an     application crash, leading to a denial of service or a limited information disclosure of heap memory     contents. (CVE-2026-82328)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
360261	AlmaLinux 9.2 [TuxCare] Security Update: gimp / gimp-devel / gimp-devel-tools / gimp-libs (ALMALINUX9.2:CLSA-2026:1788427757)	Nessus	Alma Linux Local Security Checks	Local	medium
352941	Rocky Linux 9.6 [TuxCare] Security Update: gimp / gimp-devel / gimp-devel-tools / gimp-libs (ALMALINUX9.6:CLSA-2026:1788429305)	Nessus	Rocky Linux Local Security Checks	Local	medium
352281	AlmaLinux 9.6 [TuxCare] Security Update: gimp / gimp-devel / gimp-devel-tools / gimp-libs (ALMALINUX9.6:CLSA-2026:1788429305)	Nessus	Alma Linux Local Security Checks	Local	medium
348350	Debian dsa-6509 : gimp - security update	Nessus	Debian Local Security Checks	Local	high
345809	Amazon Linux 2 : gimp (ALASGIMP-2026-020)	Nessus	Amazon Linux Local Security Checks	Local	high
341370	Linux Distros Unpatched Vulnerability : CVE-2026-82328	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-82328

medium

Tenable Plugins

medium

medium

medium

high

high

medium