CVE-2026-92183

A flaw was found in GIMP. This flaw allows an attacker to achieve arbitrary code execution by tricking a user into opening a specially crafted Animated Portable Network Graphics (APNG) image. The vulnerability is caused by a stack-based buffer overflow resulting from improper validation of data length during APNG file parsing.

This vulnerability is rated as an Important severity because successful exploitation can result in arbitrary code execution within the context of the user running the application, though it requires explicit user interaction to open a malicious file rather than being remotely exploitable against a network service. In Red Hat Enterprise Linux deployments, GIMP is an optional desktop utility that is not installed or enabled by default on standard server environments. Consequently, exposure is confined to graphical workstation systems where users actively process untrusted image files.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

1. Summary of action: Remove the optional GIMP package on systems where graphical image editing is not required, or implement operational controls to avoid processing untrusted image files.

2. Command example: To remove the package on Red Hat Enterprise Linux:

dnf remove gimp

3. Caveats: Removing the GIMP package disables graphical image editing workflows and might trigger the removal of dependent desktop utilities; review transaction dependencies prior to confirmation. In environments where the package must remain installed, enforce operational policies to prevent users from opening untrusted APNG files.