CVE-2026-6695 PUBLISHED

Gimp: gimp: remote code execution via crafted paa file

Assigner: redhat
Reserved: 20.04.2026 Published: 03.08.2026 Updated: 03.08.2026

A flaw was found in GIMP. A remote attacker could exploit this by tricking a user into opening a specially crafted PAA (Paint Shop Pro Array) image file. This vulnerability, a heap-based out-of-bounds write in the decode_lzss() function of the PAA file format plugin, allows data to be written beyond the intended memory buffer. This could lead to heap metadata corruption and potentially enable the attacker to execute arbitrary code on the affected system.

Metrics

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS Score: 5.5

Product Status

Vendor Red Hat
Product Red Hat Enterprise Linux 6
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 7
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 8
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 9
Versions Default: affected

Workarounds

To mitigate this issue, users should avoid opening .paa files from untrusted sources. If GIMP is not required, consider removing the gimp package to eliminate the attack vector. Removing the gimp package may also remove other desktop-related packages that depend on it.

Credits

  • Red Hat would like to thank JungWooJJING for reporting this issue.

References

Problem Types

  • Buffer Access with Incorrect Length Value CWE