CVE-2026-40917
Medium · 5.0CVSS
5.0
EPSS
0.2%
Published
Apr 15, 2026
CISA due date
—
The record
A flaw was found in GIMP. This vulnerability, a heap buffer over-read in the `icns_slurp()` function, occurs when processing specially crafted ICNS image files. An attacker could provide a malicious ICNS file, potentially leading to application crashes or information disclosure on systems that process such files.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | gimp | 0 | 3.0.8-bp160.4.1 |
Related vulnerabilities
- CVE-2026-4154 GIMP XPM File Parsing Integer Overflow Remote Code Execution Vulnerability. Also affects gimp
- CVE-2026-4150 GIMP PSD File Parsing Integer Overflow Remote Code Execution Vulnerability. Also affects gimp
- CVE-2026-4153 GIMP PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. Also affects gimp
- CVE-2026-4151 GIMP ANI File Parsing Integer Overflow Remote Code Execution Vulnerability. Also affects gimp
- CVE-2026-2239 A flaw was found in GIMP. Also affects gimp
- CVE-2025-15059 GIMP PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. Also affects gimp
- CVE-2025-14422 GIMP PNM File Parsing Integer Overflow Remote Code Execution Vulnerability. Also affects gimp
- CVE-2025-14424 GIMP XCF File Parsing Use-After-Free Remote Code Execution Vulnerability. Also affects gimp