CVE catalog
CVE-2026-6695
A flaw was found in GIMP. A remote attacker could exploit this by tricking a user into opening a specially crafted PAA (Paint Shop Pro Array) image file. This vulnerability, a heap-based out-of-bounds
- Severity
- Medium · CVSS 5.5
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.34% · Oct 25, 2026
A flaw was found in GIMP. A remote attacker could exploit this by tricking a user into opening a specially crafted PAA (Paint Shop Pro Array) image file. This vulnerability, a heap-based out-of-bounds write in the decode_lzss() function of the PAA file format plugin, allows data to be written beyond the intended memory buffer. This could lead to heap metadata corruption and potentially enable the attacker to execute arbitrary code on the affected system.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | gimp | sid | 3.2.6-1 | fixed |
| Debian | gimp | forky | 3.2.6-1 | fixed |
| Debian | gimp | trixie | 3.0.4-3+deb13u10 | not affected |
| Debian | gimp | trixie-security | 3.0.4-3+deb13u11 | not affected |
| Debian | gimp | bookworm | 2.10.34-1+deb12u10 | not affected |
| Debian | gimp | bookworm-security | 2.10.34-1+deb12u10 | not affected |
| Cpe | gimp | Not reported | Not reported | unknown |
| Cpe | enterprise_linux | Not reported | Not reported | unknown |
| Ubuntu | gimp | pro | 2.10.34-1 | vulnerable |
| Ubuntu | gimp | pro | 2.10.36-1 | vulnerable |
| Ubuntu | gimp | pro | 2.10.36-2 | vulnerable |
| Ubuntu | gimp | pro | 2.10.36-3build2 | vulnerable |
| Ubuntu | gimp | pro | 2.10.36-3build3 | vulnerable |
| Ubuntu | gimp | pro | 2.10.36-3ubuntu0.24.04.1 | vulnerable |
| Ubuntu | gimp | pro | 2.10.36-3ubuntu0.24.04.1+esm1 | vulnerable |
| Ubuntu | gimp | pro | 2.10.36-3ubuntu0.24.04.1+esm2 | vulnerable |
| Ubuntu | gimp | pro | 2.10.36-3ubuntu0.24.04.1+esm3 | vulnerable |
| Ubuntu | gimp | 26.04 | 3.0.4-6.1 | vulnerable |
| Ubuntu | gimp | 26.04 | 3.0.4-6.2 | vulnerable |
| Ubuntu | gimp | 26.04 | 3.0.6-1 | vulnerable |
| Ubuntu | gimp | 26.04 | 3.2.0~RC2-2 | vulnerable |
| Ubuntu | gimp | 26.04 | 3.2.0~RC2-3 | vulnerable |
| Ubuntu | gimp | 26.04 | 3.2.0~RC2-3.1 | vulnerable |
| Ubuntu | gimp | 26.04 | 3.2.0~RC2-3.2 | vulnerable |
| Ubuntu | gimp | 26.04 | 3.2.0~RC2-3.3 | vulnerable |
| Ubuntu | gimp | 26.04 | 3.2.0~RC3-1 | vulnerable |
| Ubuntu | gimp | 26.04 | 3.2.0-1 | vulnerable |
| Ubuntu | gimp | 26.04 | 3.2.2-1 | vulnerable |
| Ubuntu | gimp | 26.04 | 3.2.2-1ubuntu0.26.04.1 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | gimp | source | sid | 3.2.4-1 | not yet assigned | Not reported | Not reported |
| Debian | gimp | source | forky | 3.2.4-1 | not yet assigned | Not reported | Not reported |
| Debian | gimp | source | trixie | Not affected | unimportant | Not reported | Not reported |
| Debian | gimp | source | bookworm | Not affected | unimportant | Not reported | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [gimp]Not affected
Details (4)
2.10.34-1+deb12u10· amd64 · bookwormNot affected
nvd · gimp · debian · bookworm
2.10.34-1+deb12u10· arm64 · bookwormNot affected
nvd · gimp · debian · bookworm
2.10.34-1+deb12u10· amd64 · bookworm-securityNot affected
nvd · gimp · debian · bookworm
2.10.34-1+deb12u10· arm64 · bookworm-securityNot affected
nvd · gimp · debian · bookworm
- [gimp-data]Not affected
Source package: [gimp]
Details (4)
2.10.34-1+deb12u10· all · bookwormNot affected
nvd · gimp · debian · bookworm
2.10.34-1+deb12u10· all · bookwormNot affected
nvd · gimp · debian · bookworm
2.10.34-1+deb12u10· all · bookworm-securityNot affected
nvd · gimp · debian · bookworm
2.10.34-1+deb12u10· all · bookworm-securityNot affected
nvd · gimp · debian · bookworm
- [libgimp2.0]Not affected
Source package: [gimp]
Details (4)
2.10.34-1+deb12u10· amd64 · bookwormNot affected
nvd · gimp · debian · bookworm
2.10.34-1+deb12u10· arm64 · bookwormNot affected
nvd · gimp · debian · bookworm
2.10.34-1+deb12u10· amd64 · bookworm-securityNot affected
nvd · gimp · debian · bookworm
2.10.34-1+deb12u10· arm64 · bookworm-securityNot affected
nvd · gimp · debian · bookworm
- [libgimp2.0-dev]Not affected
Source package: [gimp]
Details (4)
2.10.34-1+deb12u10· amd64 · bookwormNot affected
nvd · gimp · debian · bookworm
2.10.34-1+deb12u10· arm64 · bookwormNot affected
nvd · gimp · debian · bookworm
2.10.34-1+deb12u10· amd64 · bookworm-securityNot affected
nvd · gimp · debian · bookworm
2.10.34-1+deb12u10· arm64 · bookworm-securityNot affected
nvd · gimp · debian · bookworm
- [libgimp2.0-doc]Not affected
Source package: [gimp]
Details (4)
2.10.34-1+deb12u10· all · bookwormNot affected
nvd · gimp · debian · bookworm
2.10.34-1+deb12u10· all · bookwormNot affected
nvd · gimp · debian · bookworm
2.10.34-1+deb12u10· all · bookworm-securityNot affected
nvd · gimp · debian · bookworm
2.10.34-1+deb12u10· all · bookworm-securityNot affected
nvd · gimp · debian · bookworm
Observed:
References
- [https://nvd.nist.gov/vuln/detail/CVE-2026-6695]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-6695]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2026-6695]
- [https://security-tracker.debian.org/tracker/CVE-2026-6695]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6695.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2616.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]