Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
GNOME GIMP — Gimp: out-of-bounds read in file-icns plugin causes information disclosure or crash on crafted icns images
AV AC PR UI S C I A CVSS EPSS %ile KEV
L L N R U H N H 7.1 .0021 12.1 —
AFFECTED
Product Versions Fixed
GIMP 2.99.14 – —
Red Hat Enterprise Linux 9 unspecified 2:3.0.4-4.el9_8.9
Red Hat Enterprise Linux 6 unspecified —
Red Hat Enterprise Linux 7 unspecified —
Red Hat Enterprise Linux 8 unspecified —
TIMELINE
Jul 27 EXPLOIT PUBLISHED — CVE-2026-66759 (GNOME GIMP). Public exploit reference added.
Jul 27 Reserved by redhat
Jul 27 Published (CNA: redhat)
Aug 7 EXPLOIT PUBLISHED — CVE-2026-66759 (GNOME GIMP). Public exploit reference added.
Description
A flaw was found in the file-icns plugin in GIMP. When applying a decompressed mask during ICNS image processing, the plugin reads from the mask data buffer without verifying if the cursor exceeds the allocated resource size. If a crafted file contains a truncated mask resource, the icns_decompress function continues reading past the bounds of the buffer. This out-of-bounds read vulnerability results in information disclosure of heap contents, where memory contents are leaked as alpha channel pixel values, or a crash leading to a denial of service if unmapped memory is accessed.
Lifecycle
Complete event history — 4 events, chronological
| Date | Event | Detail |
|---|
| July 27, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-66759 (GNOME GIMP). Public exploit reference added. |
| July 27, 2026 | Reserved | Reserved by redhat |
| July 27, 2026 | Published | Published (CNA: redhat) |
| August 7, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-66759 (GNOME GIMP). Public exploit reference added. |
Affected
Affected products and packages — 5 rows
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| GNOME | GIMP | — | 2.99.14 | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — | 2:3.0.4-4.el9_8.9 |
| Red Hat | Red Hat Enterprise Linux 6 | — | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-66759 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.