CVE-2026-42169 — Vulnerability intelligence

redhat — enterprise linux

Published: 2026-08-04T03:15:25.271Z

CVSS

7.3

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

A heap-buffer-overflow vulnerability exists in the APNG (Animated PNG) file loader of GIMP. This flaw occurs when the `fcTL` width exceeds the `IHDR` width, leading to pixel data being written past the end of a heap allocation. Additionally, a heap-based buffer overflow exists in the DDS plug-in due to a BPP mismatch in the `load_layer()` function. Both vulnerabilities can be triggered by opening a specially crafted image file, potentially leading to code execution.

Sources

• CVE-2026-42169
• Issue Tracking
• Issue Tracking
• Original advisory
• Original advisory
• Vendor Advisory
• Issue Tracking, Vendor Advisory
• CVE-2026-42169