GIMP has 12 CVEs on record between 2025 and 2026. Cadence is steady at roughly 5 per quarter. The busiest recent month was July 2026 with 4. The median CVSS is 7.3 (high). None have a confirmed exploitation report. The most common weakness class is CWE-190 (4).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.3
- Publish → KEV
- —
- Last 90 days
- 5 prev 4
Worst active — by depth score
CVE-2026-92183High· 7.8GIMP APNG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability68CVE-2026-2050High· 7.8GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability68CVE-2025-15059High· 7.8GIMP PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability68CVE-2026-59090High· 8.4A flaw was found in GIMP's PSD file format plugin58CVE-2026-66758High· 7.8A flaw was found in the file-fits plugin in GIMP43
GIMP vulnerabilities
CVEs affecting GIMP, newest first. Open any entry for full detail, references, and exploit status.
12 CVEsRSS
CVE-2026-92183High· 7.80dayGIMP APNG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
GIMP APNG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this …
CVE-2026-78465High· 7.0A flaw was found in the file-pcx plugin in GIMP, affecting 32-bit builds only
A flaw was found in the file-pcx plugin in GIMP, affecting 32-bit builds only. When processing a PCX image file, the plugin calculates memory allocation sizes based on the image dimensions and the number of color planes. If a crafted fil…
CVE-2026-78475Medium· 6.1A flaw was found in the file-pix (ESM) plugin in GIMP
A flaw was found in the file-pix (ESM) plugin in GIMP. When processing a specially crafted PIX image file, the plugin allocates a Variable-Length Array (VLA) on the stack without proper bounds checking, causing an unbounded stack allocat…
CVE-2026-59090High· 8.4PoCA flaw was found in GIMP's PSD file format plugin
A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the `block_rem` variable, occurs when a user opens a specially crafted `.psd` image file. The underflow leads to parser confusion, en…
CVE-2026-66758High· 7.8A flaw was found in the file-fits plugin in GIMP
A flaw was found in the file-fits plugin in GIMP. When processing a FITS image file, the plugin calculates memory allocation sizes using signed 32-bit integers for width and height. If a crafted file sets both values to large values, the…
CVE-2026-58384High· 7.3A flaw was found in GIMP's PSD parser
A flaw was found in GIMP's PSD parser. An integer overflow in read_RLE_channel() can cause an undersized heap allocation for the RLE row-length table, after which subsequent per-row writes corrupt heap memory. This could lead to memory c…
CVE-2026-58380High· 7.3A flaw was found in GIMP's PNM file format parser
A flaw was found in GIMP's PNM file format parser. When parsing a specially crafted PNM file, the pnmscanner_gettoken() function writes a null terminator one byte past the end of a stack-allocated buffer due to an off-by-one error in the…
CVE-2026-58381Medium· 6.1A flaw was found in GIMP's PSP file format parser
A flaw was found in GIMP's PSP file format parser. A double-free condition occurs in the read_layer_block() function when processing a specially crafted PSP file. This could allow an attacker to cause memory corruption, potentially leadi…
CVE-2026-2050High· 7.80dayGIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vu…
CVE-2026-6384High· 7.3A flaw was found in gimp
A flaw was found in gimp. This buffer overflow vulnerability in the GIF image loading component's `ReadJeffsImage` function allows an attacker to write beyond an allocated buffer by processing a specially crafted GIF file. This can lead …
CVE-2025-15059High· 7.80dayGIMP PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
GIMP PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vu…
CVE-2025-6035Medium· 6.1A flaw was found in GIMP
A flaw was found in GIMP. An integer overflow vulnerability exists in the GIMP "Despeckle" plug-in. The issue occurs due to unchecked multiplication of image dimensions, such as width, height, and bytes-per-pixel (img_bpp), which can re…