CVE-2026-6695

The record

A flaw was found in GIMP. A remote attacker could exploit this by tricking a user into opening a specially crafted PAA (Paint Shop Pro Array) image file. This vulnerability, a heap-based out-of-bounds write in the decode_lzss() function of the PAA file format plugin, allows data to be written beyond the intended memory buffer. This could lead to heap metadata corruption and potentially enable the attacker to execute arbitrary code on the affected system.

Affected packages

Related vulnerabilities

• CVE-2026-53877 An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. CWE-805
• CVE-2026-12549 The fix for CVE-2026-2443 was regressed by a subsequent rework commit that replaced… CWE-805
• CVE-2026-1767 A flaw was found in the GNOME localsearch (previously known as tracker-miners) MP3… CWE-805
• CVE-2026-1766 A flaw was found in GNOME localsearch (previously known as tracker-miners) MP3 Extractor… CWE-805
• CVE-2026-12087 Socket versions before 2.041 for Perl have an out-of-bounds heap read. CWE-805
• CVE-2026-34002 A flaw was found in the X.Org X server. CWE-805
• CVE-2025-63547 An issue in Eprosima Micro-XREC-DDS Agent v.3.0.1 allows a remote attacker to cause a… CWE-805
• CVE-2026-41035 In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a… CWE-805