CVE-2026-6694 PUBLISHED

Gimp: gimp file-png plugin: denial of service via oversized apng trns chunk

Assigner: redhat
Reserved: 20.04.2026 Published: 03.08.2026 Updated: 03.08.2026

A flaw was found in GIMP's file-png plugin. A remote attacker can exploit this by crafting a malicious Animated Portable Network Graphics (APNG) image containing an oversized tRNS chunk. This can lead to a stack-based buffer overflow (CWE-121), causing the file-png plugin to crash and resulting in a Denial of Service (DoS) for the user.

Metrics

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS Score: 5.5

Product Status

Vendor Red Hat
Product Red Hat Enterprise Linux 6
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 7
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 8
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 9
Versions Default: affected

Workarounds

To mitigate this issue, avoid opening or processing untrusted APNG (Animated Portable Network Graphics) image files with GIMP. Since the vulnerability is triggered by malformed APNG content, restricting interaction with such files will prevent the file-png plugin from crashing. If the plugin crashes, restarting GIMP may be necessary to restore full functionality.

Credits

  • Red Hat would like to thank Bronson Yen (Calif.io) for reporting this issue.

References

Problem Types

  • Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE