CVEFinder.io

CVE-2026-58380

⚠ī¸ high
🔍 Scan for this CVE
Summary

A flaw was found in GIMP's PNM file format parser. When parsing a specially crafted PNM file, the pnmscanner_gettoken() function writes a null terminator one byte past the end of a stack-allocated buffer due to an off-by-one error in the loop boundary check. This could lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.

CVSS Score
7.3
High
EPSS Score
0.2
Exploit Probability
Published Date
2026-07-06
First Seen: 2026-07-07
📊 Relative Risk Intelligence

This CVE is Moderate Risk - more severe than 55.4% of all 335,187 vulnerabilities in our database.

#149,529
Above average severity
Severity Percentile
đŸŽ¯ CISA SSVC Assessment Updated: Jul 6, 2026
🔍 Exploitation Status
None
No known exploits
⚙ī¸ Automatable
NO
Requires human interaction
đŸ’Ĩ Technical Impact
Total
Complete system compromise possible
🏆 Discovered By
Red Hat would like to thank bb1abu for reporting this issue.
SSVC data provided by CISA
Last Modified 2026-07-10
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CWE IDs (Weakness Types)
CWE-193

đŸ“Ļ Affected Products 4

Vendor Product Status Affected Versions
redhat enterprise_linux Affected
v7.0
redhat enterprise_linux Affected
v8.0
redhat enterprise_linux Affected
v9.0
gimp gimp Affected
v3.2.4

🔗 References 4

https://access.redhat.com/security/cve/CVE-2026-58380
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2496135
Issue Tracking Third Party Advisory
https://gitlab.gnome.org/GNOME/gimp/-/commit/83699817
Broken Link
https://gitlab.gnome.org/GNOME/gimp/-/issues/16206
Exploit Issue Tracking Vendor Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-15041 ℹī¸ low 3.7 0.3 A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password verification function uses standard memcmp() for co... 2026-07-08
CVE-2026-58384 ⚠ī¸ high 7.3 0.2 A flaw was found in GIMP's PSD parser. An integer overflow in read_RLE_channel() can cause an undersized heap allocation... 2026-07-07
CVE-2026-14940 đŸ”ļ medium 5.3 0.3 A heap-buffer-overflow flaw was found in 389 Directory Server (389-ds-base). When normalizing a Distinguished Name (DN) ... 2026-07-07
CVE-2026-14969 đŸ”ļ medium 4.4 0.1 A flaw was found in 389-ds-base where the LDBM backend attribute encryption uses a hardcoded static initialization vecto... 2026-07-07
CVE-2026-59089 đŸ”ļ medium 5.5 0.2 A flaw was found in GIMP. The PlayStation TIM loader, responsible for handling PlayStation image files, incorrectly calc... 2026-07-06
CVE-2026-12610 đŸ”ļ medium 6.4 0.2 A flaw was found in sssd. When authenticating with a YubiKey, the SSSD PAM responder can crash due to a use-after-free v... 2026-06-30
These CVEs affect the same products