CVE-2026-78475
🔶 mediumSummary
A flaw was found in the file-pix (ESM) plugin in GIMP. When processing a specially crafted PIX image file, the plugin allocates a Variable-Length Array (VLA) on the stack without proper bounds checking, causing an unbounded stack allocation followed by a 21-byte stack over-read. This can result in a denial of service due to stack exhaustion and a limited information disclosure of stack memory contents into an intermediate file.
CVSS Score
6.1
Medium
EPSS Score
0.2
Exploit Probability
Published Date
2026-08-24
First Seen: 2026-08-25
📊 Relative Risk Intelligence
This CVE is Lower Risk - more severe than 37.4% of all 360,548 vulnerabilities in our database.
#225,528
Below average severity
Severity Percentile
🎯 CISA SSVC Assessment Updated: Aug 24, 2026
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Partial
Limited system impact
🏆 Discovered By
Red Hat would like to thank Zhixi "Jace" Sun for reporting this issue.
SSVC data provided by
CISA
Last Modified
2026-09-01
Source
NVD 🔗
CVSS Vector 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
CWE IDs (Weakness Types)