Catálogo de CVE

CVE-2026-6384

A flaw was found in gimp. This buffer overflow…

A flaw was found in gimp. This buffer overflow vulnerability in the GIF image loading component's `ReadJeffsImage` function allows an attacker to write beyond an allocated buffer by processing a specially crafted GIF file. This can lead to a denial of service or potentially arbitrary code execution.

Gravidade: High · CVSS 7.3CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Published: Apr 15, 2026, 6:41:34 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.26% · Oct 27, 2026

Projects and upstream resources

[gimp][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiansid	gimp	`3.2.2-1`	FixedDistribution-reported fixed boundary	[CVE-2026-6384]
Debiansid	gimp	`3.2.6-1`	Fixed	[CVE-2026-6384]
Debianforky	gimp	`3.2.2-1`	FixedDistribution-reported fixed boundary	[CVE-2026-6384]
Debianforky	gimp	`3.2.6-1`	Fixed	[CVE-2026-6384]

Showing 4 fix observations. All 31 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
UnknownRelease not reported	enterprise_linux	Not reported	UnknownSource applicability is not established	Provider not reported
UnknownRelease not reported	gimp	Not reported	UnknownSource applicability is not established	Provider not reported
Debianbookworm	gimp	Not reported	Not affectedDistribution reports not affected	[CVE-2026-6384]
Debianbookworm	gimp	`2.10.34-1+deb12u10`	Not affected	[CVE-2026-6384]
Debianbookworm-security	gimp	`2.10.34-1+deb12u10`	Not affected	[CVE-2026-6384]
Debianforky	gimp	`3.2.2-1`	FixedDistribution-reported fixed boundary	[CVE-2026-6384]
Debianforky	gimp	`3.2.6-1`	Fixed	[CVE-2026-6384]
Debiansid	gimp	`3.2.2-1`	FixedDistribution-reported fixed boundary	[CVE-2026-6384]
Debiansid	gimp	`3.2.6-1`	Fixed	[CVE-2026-6384]
Debiantrixie	gimp	Not reported	Not affectedDistribution reports not affected	[CVE-2026-6384]
Debiantrixie	gimp	`3.0.4-3+deb13u10`	Not affected	[CVE-2026-6384]
Debiantrixie-security	gimp	`3.0.4-3+deb13u11`	Not affected	[CVE-2026-6384]
Ubuntu25.10	gimp	`3.0.2-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-6384]May 14, 2026, 2:54:37 PM UTC
Ubuntu25.10	gimp	`3.0.2-2`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-6384]May 14, 2026, 2:54:37 PM UTC
Ubuntu25.10	gimp	`3.0.2-3`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-6384]May 14, 2026, 2:54:37 PM UTC
Ubuntu25.10	gimp	`3.0.2-3.1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-6384]May 14, 2026, 2:54:37 PM UTC
Ubuntu25.10	gimp	`3.0.4-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-6384]May 14, 2026, 2:54:37 PM UTC
Ubuntu25.10	gimp	`3.0.4-2`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-6384]May 14, 2026, 2:54:37 PM UTC
Ubuntu25.10	gimp	`3.0.4-3`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-6384]May 14, 2026, 2:54:37 PM UTC
Ubuntu25.10	gimp	`3.0.4-5`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-6384]May 14, 2026, 2:54:37 PM UTC
Ubuntu25.10	gimp	`3.0.4-6`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-6384]May 14, 2026, 2:54:37 PM UTC
Ubuntu25.10	gimp	`3.0.4-6.1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-6384]May 14, 2026, 2:54:37 PM UTC
Ubuntupro	gimp	`2.10.34-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-6384]May 14, 2026, 2:54:37 PM UTC
Ubuntupro	gimp	`2.10.36-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-6384]May 14, 2026, 2:54:37 PM UTC
Ubuntupro	gimp	`2.10.36-2`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-6384]May 14, 2026, 2:54:37 PM UTC
Ubuntupro	gimp	`2.10.36-3build2`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-6384]May 14, 2026, 2:54:37 PM UTC
Ubuntupro	gimp	`2.10.36-3build3`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-6384]May 14, 2026, 2:54:37 PM UTC
Ubuntupro	gimp	`2.10.36-3ubuntu0.24.04.1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-6384]May 14, 2026, 2:54:37 PM UTC
Ubuntupro	gimp	`2.10.36-3ubuntu0.24.04.1+esm1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-6384]May 14, 2026, 2:54:37 PM UTC
Ubuntupro	gimp	`2.10.36-3ubuntu0.24.04.1+esm2`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-6384]May 14, 2026, 2:54:37 PM UTC
Ubuntupro	gimp	`2.10.36-3ubuntu0.24.04.1+esm3`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-6384]May 14, 2026, 2:54:37 PM UTC

Original provider fields

{
  "package_releases": [
    {
      "name": "gimp",
      "status": "fixed",
      "release": "sid",
      "version": "3.2.6-1"
    },
    {
      "name": "gimp",
      "status": "fixed",
      "release": "forky",
      "version": "3.2.6-1"
    },
    {
      "name": "gimp",
      "status": "not affected",
      "release": "trixie",
      "version": "3.0.4-3+deb13u10"
    },
    {
      "name": "gimp",
      "status": "not affected",
      "release": "trixie-security",
      "version": "3.0.4-3+deb13u11"
    },
    {
      "name": "gimp",
      "status": "not affected",
      "release": "bookworm",
      "version": "2.10.34-1+deb12u10"
    },
    {
      "name": "gimp",
      "status": "not affected",
      "release": "bookworm-security",
      "version": "2.10.34-1+deb12u10"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "gimp",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "3.2.2-1"
    },
    {
      "bug": null,
      "name": "gimp",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "3.2.2-1"
    },
    {
      "bug": null,
      "name": "gimp",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "unimportant",
      "fixed_version": "0"
    },
    {
      "bug": null,
      "name": "gimp",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "unimportant",
      "fixed_version": "0"
    }
  ],
  "distribution_packages": [
    {
      "name": "gimp",
      "fixed_version": "",
      "applicability_unknown": true
    },
    {
      "name": "enterprise_linux",
      "fixed_version": "",
      "applicability_unknown": true
    },
    {
      "name": "gimp",
      "fixed_version": "0",
      "applicability_unknown": true
    },
    {
      "name": "gimp",
      "ranges": [],
      "ecosystem": "cpe",
      "provider_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6384",
      "fixed_version": "",
      "provider_source": "nvd",
      "provider_record_id": "NVD-CVE-2026-6384",
      "provider_updated_at": "2026-10-26T21:10:00.170"
    },
    {
      "name": "enterprise_linux",
      "ranges": [],
      "ecosystem": "cpe",
      "provider_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6384",
      "fixed_version": "",
      "provider_source": "nvd",
      "provider_record_id": "NVD-CVE-2026-6384",
      "provider_updated_at": "2026-10-26T21:10:00.170"
    },
    {
      "name": "gimp",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "2.10.34-1",
        "2.10.36-1",
        "2.10.36-2",
        "2.10.36-3build2",
        "2.10.36-3build3",
        "2.10.36-3ubuntu0.24.04.1",
        "2.10.36-3ubuntu0.24.04.1+esm1",
        "2.10.36-3ubuntu0.24.04.1+esm2",
        "2.10.36-3ubuntu0.24.04.1+esm3"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-6384",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-6384",
      "provider_updated_at": "2026-05-14T14:54:37.625219Z",
      "applicability_unknown": true
    },
    {
      "name": "gimp",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "25.10",
      "versions": [
        "3.0.2-1",
        "3.0.2-2",
        "3.0.2-3",
        "3.0.2-3.1",
        "3.0.4-1",
        "3.0.4-2",
        "3.0.4-3",
        "3.0.4-5",
        "3.0.4-6",
        "3.0.4-6.1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-6384",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-6384",
      "provider_updated_at": "2026-05-14T14:54:37.625219Z",
      "applicability_unknown": true
    }
  ]
}

OpenFactory catalog packages

A associação de pacotes está em andamento.

[Debian 12 (Bookworm)]

[gimp]Desconhecido
Detalhes (4)
- 2.10.34-1+deb12u10 · amd64 · bookworm
  Não afetada
  nvd · gimp · debian · bookworm
- 2.10.34-1+deb12u10 · arm64 · bookworm
  Não afetada
  nvd · gimp · debian · bookworm
- 2.10.34-1+deb12u10 · amd64 · bookworm-security
  Não afetada
  nvd · gimp · debian · bookworm
- 2.10.34-1+deb12u10 · arm64 · bookworm-security
  Não afetada
  nvd · gimp · debian · bookworm
[gimp-data]Desconhecido
Pacote fonte: [gimp]
Detalhes (4)
- 2.10.34-1+deb12u10 · all · bookworm
  Não afetada
  nvd · gimp · debian · bookworm
- 2.10.34-1+deb12u10 · all · bookworm
  Não afetada
  nvd · gimp · debian · bookworm
- 2.10.34-1+deb12u10 · all · bookworm-security
  Não afetada
  nvd · gimp · debian · bookworm
- 2.10.34-1+deb12u10 · all · bookworm-security
  Não afetada
  nvd · gimp · debian · bookworm
[libgimp2.0]Desconhecido
Pacote fonte: [gimp]
Detalhes (4)
- 2.10.34-1+deb12u10 · amd64 · bookworm
  Não afetada
  nvd · gimp · debian · bookworm
- 2.10.34-1+deb12u10 · arm64 · bookworm
  Não afetada
  nvd · gimp · debian · bookworm
- 2.10.34-1+deb12u10 · amd64 · bookworm-security
  Não afetada
  nvd · gimp · debian · bookworm
- 2.10.34-1+deb12u10 · arm64 · bookworm-security
  Não afetada
  nvd · gimp · debian · bookworm
[libgimp2.0-dev]Desconhecido
Pacote fonte: [gimp]
Detalhes (4)
- 2.10.34-1+deb12u10 · amd64 · bookworm
  Não afetada
  nvd · gimp · debian · bookworm
- 2.10.34-1+deb12u10 · arm64 · bookworm
  Não afetada
  nvd · gimp · debian · bookworm
- 2.10.34-1+deb12u10 · amd64 · bookworm-security
  Não afetada
  nvd · gimp · debian · bookworm
- 2.10.34-1+deb12u10 · arm64 · bookworm-security
  Não afetada
  nvd · gimp · debian · bookworm
[libgimp2.0-doc]Desconhecido
Pacote fonte: [gimp]
Detalhes (4)
- 2.10.34-1+deb12u10 · all · bookworm
  Não afetada
  nvd · gimp · debian · bookworm
- 2.10.34-1+deb12u10 · all · bookworm
  Não afetada
  nvd · gimp · debian · bookworm
- 2.10.34-1+deb12u10 · all · bookworm-security
  Não afetada
  nvd · gimp · debian · bookworm
- 2.10.34-1+deb12u10 · all · bookworm-security
  Não afetada
  nvd · gimp · debian · bookworm

Observado: Oct 27, 2026, 7:59:07 AM UTC

Referências

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]