CVE-2026-42169: A heap-buffer-overflow vulnerability exists in the APNG (Animated PNG) file loader of GIMP. This flaw occurs when the `fcTL` width exceeds the `IHDR` width, leading to pixel data b
A heap-buffer-overflow vulnerability exists in the APNG (Animated PNG) file loader of GIMP. This flaw occurs when the fcTL width exceeds the IHDR width, leading to pixel data being written past the end of a heap allocation. Additionally, a heap-based buffer overflow exists in the DDS plug-in due to a BPP mismatch in the load_layer() function. Both vulnerabilities can be triggered by opening a specially crafted image file, potentially leading to code execution.
Details
Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-42169
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-421690.13% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 3% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-42169 | coverage & exploitation status | NVD · CVE.org |
More from NVD Recent CVEs
- highCVE-2026-9203: A server-side request forgery vulnerability in Progress MarkLogic Server before 11.3.6 and 12.0…2026-08-05
- criticalCVE-2026-9195: A cross-site scripting vulnerability in the Query Console of Progress MarkLogic Server before 1…2026-08-05
- criticalCVE-2026-9193: An improper privilege management vulnerability in the Hadoop integration of Progress MarkLogic …2026-08-05
- criticalCVE-2026-9192: An authentication bypass vulnerability in the ODBC App Server of Progress MarkLogic Server befo…2026-08-05
- criticalCVE-2026-9190: An HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkLogic Server bef…2026-08-05