{"id":"CVE-2026-18300","summary":"GIMP HDR File Parsing Integer Overflow Remote Code Execution Vulnerability","details":"GIMP HDR File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of HDR files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29289.","modified":"2026-08-28T08:20:35.528489Z","published":"2026-08-20T16:22:54.633Z","database_specific":{"cna_assigner":"zdi","cwe_ids":["CWE-190"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/18xxx/CVE-2026-18300.json","unresolved_ranges":[{"extracted_events":[{"introduced":"3.2.2"},{"last_affected":"3.2.2"}],"source":"AFFECTED_FIELD"}]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/18xxx/CVE-2026-18300.json"},{"type":"ADVISORY","url":"https://gitlab.gnome.org/GNOME/gegl/-/commit/d3d262008299341c5b032b354021632ceadb2799"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18300"},{"type":"ADVISORY","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-453/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://gitlab.gnome.org/gnome/gegl","events":[{"introduced":"0"},{"fixed":"d3d262008299341c5b032b354021632ceadb2799"}],"database_specific":{"source":"REFERENCES"}}],"versions":["GEGL_0_4_70","GEGL_0_4_68","GEGL_0_4_66","GEGL_0_4_64","GEGL_0_4_62","GEGL_0_4_58","GEGL_0_4_56","GEGL_0_4_54","GEGL_0_4_52","GEGL_0_4_50","GEGL_0_4_48","GEGL_0_4_46","GEGL_0_4_44","GEGL_0_4_42","GEGL_0_4_40","GEGL_0_4_38","GEGL_0_4_36","GEGL_0_4_34","GEGL_0_4_32","GEGL_0_4_30","GEGL_0_4_28","GEGL_0_4_26","GEGL_0_4_24","GEGL_0_4_20","GEGL_0_4_18","GEGL_0_4_16","GEGL_0_4_14","GEGL_0_4_12","GEGL_0_4_10","GEGL_0_4_8","GEGL_0_4_6","GEGL_0_4_4","GEGL_0_4_2","GEGL_0_4_0","GEGL_0_3_34","GEGL_0_3_30","GEGL_0_3_28","GEGL_0_3_26","GEGL_0_3_24","GEGL_0_3_22","GEGL_0_3_20","GEGL_0_3_18","GEGL_0_3_16","GEGL_0_3_14","GEGL_0_3_12","GEGL_0_3_10","GEGL_0_3_8","GEGL_0_3_6","GEGL_0_3_4","GEGL_0_3_2","GEGL_0_3_0","GEGL_0_2_0","GEGL_0_1_8","GEGL_0_1_6","GEGL_0_1_4","GEGL_0_1_2","GEGL_0_1_0_REAL","GEGL_0_0_16","GEGL_0_0_14","GEGL_0_0_4","GEGL_BEFORE_CLEANUP","GNOME_PRINT_0_24","GEGL_20001120_v002"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-18300.json","vanir_signatures_modified":"2026-08-28T08:20:35Z","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"79649320582126362945795237980877824355","length":149},"id":"CVE-2026-18300-0c1a0e5c","signature_type":"Function","signature_version":"v1","source":"https://gitlab.gnome.org/gnome/gegl@d3d262008299341c5b032b354021632ceadb2799","target":{"file":"libs/ctx/ctx.h","function":"ctx_rasterizer_reset_soft"}},{"deprecated":false,"digest":{"function_hash":"250190858612639938331878423311540827881","length":11812},"id":"CVE-2026-18300-126cf169","signature_type":"Function","signature_version":"v1","source":"https://gitlab.gnome.org/gnome/gegl@d3d262008299341c5b032b354021632ceadb2799","target":{"file":"libs/ctx/ctx.h","function":"ctx_parser_resolve_command"}},{"source":"https://gitlab.gnome.org/gnome/gegl@d3d262008299341c5b032b354021632ceadb2799","target":{"file":"libs/ctx/ctx.h","function":"ctx_rasterizer_apply_grads_copy_normal_color"},"deprecated":false,"digest":{"function_hash":"1998726714039042008933572772693136220","length":1049},"id":"CVE-2026-18300-16ba79f7","signature_type":"Function","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://gitlab.gnome.org/gnome/gegl@d3d262008299341c5b032b354021632ceadb2799","target":{"file":"libs/ctx/ctx.h","function":"ctx_rasterizer_stroke"},"deprecated":false,"digest":{"function_hash":"84025211328750890885536817683799036792","length":6320},"id":"CVE-2026-18300-2c1724aa"},{"target":{"file":"libs/ctx/ctx.h","function":"ctx_rasterizer_feed_edges_full"},"deprecated":false,"digest":{"function_hash":"292368829887974974512663846395908432191","length":2122},"id":"CVE-2026-18300-3cda0422","signature_type":"Function","signature_version":"v1","source":"https://gitlab.gnome.org/gnome/gegl@d3d262008299341c5b032b354021632ceadb2799"},{"source":"https://gitlab.gnome.org/gnome/gegl@d3d262008299341c5b032b354021632ceadb2799","target":{"file":"libs/ctx/ctx.h","function":"(ctx_rasterizer_rasterize_edges)"},"deprecated":false,"digest":{"function_hash":"282432260037277012323408468300669503860","length":497},"id":"CVE-2026-18300-50b23c9a","signature_type":"Function","signature_version":"v1"},{"target":{"file":"libs/rgbe/rgbe.c"},"deprecated":false,"digest":{"line_hashes":["266463162357425861373171312791609802694","242462423156929363080939498942731370429","205808523917827903013955651059162721081"],"threshold":0.9},"id":"CVE-2026-18300-53918da0","signature_type":"Line","signature_version":"v1","source":"https://gitlab.gnome.org/gnome/gegl@d3d262008299341c5b032b354021632ceadb2799"},{"deprecated":false,"digest":{"function_hash":"261370790823940205837726566245226840525","length":1041},"id":"CVE-2026-18300-6b655ac5","signature_type":"Function","signature_version":"v1","source":"https://gitlab.gnome.org/gnome/gegl@d3d262008299341c5b032b354021632ceadb2799","target":{"file":"libs/rgbe/rgbe.c","function":"rgbe_read_scanlines"}},{"signature_version":"v1","source":"https://gitlab.gnome.org/gnome/gegl@d3d262008299341c5b032b354021632ceadb2799","target":{"file":"libs/ctx/ctx.h","function":"murmur3_32_process"},"deprecated":false,"digest":{"function_hash":"116595015640255667449086297865628963056","length":537},"id":"CVE-2026-18300-8246341b","signature_type":"Function"},{"source":"https://gitlab.gnome.org/gnome/gegl@d3d262008299341c5b032b354021632ceadb2799","target":{"file":"libs/ctx/ctx.h","function":"ctx_sdf_f"},"deprecated":false,"digest":{"function_hash":"236413250744008101976752065795489651891","length":591},"id":"CVE-2026-18300-abbbf8b1","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"55997818653246000227805453912740877853","length":2640},"id":"CVE-2026-18300-beff7f5a","signature_type":"Function","signature_version":"v1","source":"https://gitlab.gnome.org/gnome/gegl@d3d262008299341c5b032b354021632ceadb2799","target":{"function":"ctx_rasterizer_generate_sdf","file":"libs/ctx/ctx.h"}},{"id":"CVE-2026-18300-c7853a37","signature_type":"Function","signature_version":"v1","source":"https://gitlab.gnome.org/gnome/gegl@d3d262008299341c5b032b354021632ceadb2799","target":{"function":"ctx_rasterizer_apply_grads","file":"libs/ctx/ctx.h"},"deprecated":false,"digest":{"function_hash":"40304768293265175971448406005435864741","length":1148}},{"id":"CVE-2026-18300-cf896347","signature_type":"Function","signature_version":"v1","source":"https://gitlab.gnome.org/gnome/gegl@d3d262008299341c5b032b354021632ceadb2799","target":{"file":"libs/ctx/ctx.h","function":"ctx_resource_parse_header"},"deprecated":false,"digest":{"function_hash":"123387608236043539189609620415943331817","length":2682}},{"signature_type":"Line","signature_version":"v1","source":"https://gitlab.gnome.org/gnome/gegl@d3d262008299341c5b032b354021632ceadb2799","target":{"file":"libs/ctx/ctx.h"},"deprecated":false,"digest":{"line_hashes":["66139364987982132262718316079925286945","44773390025657646301412073154639114983","23989684052785147662963464642718875877","248052415007915164210847347031507508480","68043729071588014395995685615774178174","166842938360666995563276286400736545039","149956623699120189791599864391711591780","108428465458487927689431676398856922821","221820026010913151603100991640198327911","32165677391397961348931333431392993580","187707478053279084915514845959161772363","122626249402403096112369710746455729241","203040560124978924929995076636488645820","39709231241224552715687187858518827310","190657831018940776776455800935981425243","329929381269096627468654132267430480954","154140627960171132454768340394310739650","207038047540191601251554724726781999879","231215981816253772958156996484779788593","151598510897301183398076980622984561849","178114590517030734436360510985109302173","3872281256907311312569535414039460090","302434721229685253806785356670872236813","292153574983140643052381776555220972988","90919270651494254735063269298848694573","141923858833236821924422058283802121249","174251526991668954007593788694757902598","260595268798975705143634972017952206395","150135537464509055995257410917245644226","335294772342423685792512194825917972334","86578460348544600571651977714958037152","245613806520789798157037812831468597088","173787903752997195867388825081902484605","315858938016000637722041988385751446508","5631466248233001743345366294019100061","222815151545247945775457709223077878582","27731420353282191879494448522954567752","186528891158708330618616814785118095492","272920302236534858060410069283093630244","268079982270111600871913143962943647664","2656469635901152070838919551683784725","139356447164737550385363133221339960347","333403444939460391954277306687400605827","315907082694700564357748517241007511723","7125763408624919490682887346556555937","4887339775892997648369447703724373015","237328512814111709605566875412594705315","299259817472724934167555512983421260961","118751911283032465457936515221882120469","149415202282226288091511489778323403342","35779107056603137405232243721236863324","114937391690106546490072885964533919091","175431299464752204688194095602733014028","108707889860172415966318834939250363398","68987605020062215654129904715510228924","94323653783536482594121922566275250742","215505298229024459676124492459568128129","90241774863664765821062859936877126054","3604292317831830657096713856499495544","45436917486192854264252331618568372993","229707259796040262434116392136965326812","34837328184294269105060517248236212714","13948861639333207330452788154306482054","198783354886804153255426578298709123653","93036080573460559206018189721696525812","149988699892859040535150257963545130481","97871522800527568629772856700651819420","92487289383717305172859796589068430279","132801896095493958760319007722498267776","143121028635386153840562781619946448449","200790515574559652042261835183687288822","272776195817756400882838708228411850190","303790820548799466302975393982553668935","251254456616962565846980412241802468708","170200503406110425173143382645618862754","297184621465900351545830391737714600066","259270568209534398182055892703120024986","280950969565540019406653175289525489461","66335873919007219147329997253300133116","16271041805414098789958239271873690018","312593878917217815657640978454126687968","12645365244437732184068435759667669859","290041959371689948938092450832743482649","254770799546577071557013082855318440186","106380883033000803064786187487029903214","229815290283193398186931028304024080926","270562580328376875467856373610637575612","244554180196961599634298305668803429199","227986561302884482924586127368175890930","44174853812505253791539077388467542758","262897992460119572150495711664025888390","92434949600898320863787357498786170383","154525721538665222393439929794796036735","337818749512463906057602995734803337330","337527852762280528724643718917917327066","134477929264928753046231640636733928692","293449684063959927333867182988097602918","140319486033925985601160217213976411591","64949049469795578463119748957596453319","286983658883908574230072205747976986628","64281539714770542143847068081305336752","205706836667122642948404808528558014737","68988890286708098534135385000279479705","230504152136282820199838626185965780783","183638129429618219658550831756046533570","245844766945535427564825914271194533217","52229277134773664782484270812955982413","145258640859764967244255268030608906622","15284253123827457213200958995007004947","137433246497702215390365582090309331435","39015248424609681248612015853094462988","263995078104823293393351566573198502949","206229437232814485172138009902571650271","129006856209752837018664493108248598402","322840924340054905726003706478654616074","275383984000464938614553847188782690745","81927816863808729242630951616368693267","20749026420338878622124843132869906973","136553485122110146521032808691645455436","175083719942568039576293611413684574365","267093890280189384002805189884795275790","276739993748872323644296280564114668161","106024216488677406869685792434105467548","14291194462589827004130454279431428327","185855327050180833629928529904923644906","282451338009799640502783526918272798155","179485762181817347738986050733422362790","23404779044869889592029508451800069368","240171847253270283168378509747452333983","41626170312730415376357276065856860833","170560529410964180438800832863400528879","154387851518524088791945437217417788124","21880843891606152897215442247764771797","325149318946001276301338314630161669701","127171712237156355316113341646323329719","49371855135561680033106920785866080938","340186569762020579207747277492341222062","308718928594415221941124502024370181565","239755455827641077825562608382307925533","300052847597405949384889707727551110245","189852781502489999013340011678767789243","147376667830430769590519605318060153082","290302269849428197444521552078896322374","84344139562617142119835550784275870260","274781860243044981830762025695255097408","92504673357391402152117761403958066591","324034635706819006664718186698117341729","23180713033450463472126435272412366472","17764180765588649941284347203243006585","12699465205246959862961260120529443303","126554417211313179994735160444459249542","318852950069726356941626324297210864478","56056109709314589895187410124303417483","21967884787533232357867428817145923984","141787716127235378851968519414296676832","235572847447523347001796689272751135493","61711269178148418858118796770799658191","244968773248595731777353526995289220136","250314992649459845097358645898903426398","221283109643586068145475464808989159783","43545971540011557269335972613577818043","333418522672248978301139821905949572838","100396886373752253806315336995688355093","86070439530126372775779829258839233666","124827445337716773937775168575601038675","67260163349346432746738850927954029357","188625576562150313844642101365637146415","134866117434994538008630879798870491427","47196016733896043758446044377372755021","299682830901623604236497716549431744572","196219096830457726827160056027908049252","250766971716226830940210028700295642870","208137613827960368001396399805720763069","160422130547184298596136491690724486255","36205613088430450253610672475614852864","9123004540499443411164876742242787469","308563681584032869195633604500532556682","188910304286979224552803676191583381242","286648568209023141030639918207333844990","56216320152572903499888735140631823133","37919387230069408347839209680460604037","134866117434994538008630879798870491427","208137613827960368001396399805720763069","160422130547184298596136491690724486255","36205613088430450253610672475614852864","108543512479273723698709802658819054697","306616412575211213464052955650978919295","90409891843155239117827273928275259907","22049140284371128150803111979927140296","266664146939374994873457409287677572118","79054056677691289097457461677196763240","98981738036981454130489800803428770702","132178385718729517646322002985651868271","194277536163287696499714295502441683767","329390127157173080596245446547295959339","201181755767168587972635787534135607360","125043105688787457775678610087959219417","83541926291600218894788078598019818102","272215196216823095205300029407214108020","2525328919904064845561983452212232166","30787071934066398974457107267171494149","312526821068139056082143661776257536390","300477505279326446625976077994637225042","27446008114575336800417939039656792750","321484000655911103306254704653164601509","109328131540031910785407409696675499226","248228568665687034387634756253869767036","237395279759984387437236146753724961979","80000472007800600229772975115379075543","44248490118073142226370624247758119243","103819628791665526633610284636750431607","141230743584809453674387377144409492815","181626206778978768886056257099581558276","313996024886968239059750741601209519743","148486103642747406226207658373894690264","163042690603860275146959627023601106441","160287383906165028127293540302605008890","305466637200345828148532772644738056014","136494243225461068722527220213495956879","259055424106266885052229197229679871670","63891587590952240844833074659153823527","120667700372556630328020781824216530820","16256964363104877200356972292413515644","213128196843855572101241534523484789972","31312482337973980101421333126181275475","261319092766835017905963144088008495943","250423567161591071571647960489876485726","157188734386369612250492306512558979485","96086333391986752157139590790778625289","263494351430320208697214815245603406626","31312482337973980101421333126181275475","261319092766835017905963144088008495943","116987177100282648937277913990790130648","210530853898597227484091807671347915842","67374979608197105118138628575962028029","278834470942120570925047586399909224048","157774465766169249515938366843956673361","198106894331842409571741165742308696668","11517593893850956083684687873540924002","176740273144520644589237081288988464263","301285515300001580711965240751003845270","230386553093310469879887817435731208457","323703265906817181404866305953168189931","218672408837447537555230301833339685854","267493647693810325336201315629383130961","251925054729110886538725390727427307533","284927337112556666836084006578458938385","155297486948153905712967046271289135943","222829971984558487828447241963759340946","78547472005737657485535396944033338152","291445958996223817440585096079557814028","283299934071877758249250257294506002525","216252413355031061840267060153851918327","317562390672567248588651695862557177714","126775668653795804160930509792596984640","73647564894741911828031990990447778967","180380326542452844205570486214201096800","295987738109493526541647014665974242752","145408069838851387159724804873993187474","231742975312950004818029520600446531267","334231435225663197092487198376603382020","160621955926753304436931973413265281116","310297969314043520022442792022374447304","256765225178188278738853059237945307582","182499162923805888030874908037470956671","110898262665719244537520139468509205454","186300038197199291607940504251885802733","16407650528552099210774189616233996441","91778625776558829591432683384940898688","224684776366420406655352146465983104328","99363081465689216245193829251601116973","113316140889270938371765759312810621698","308231268049115843789762792692383158628","218908958712996284609428046714977123570","300062146032689910395660902181827070447","329468515387561612885953612342586382931","305976899537191921085458209752967767091","155471912789216776072644889262754673858","321133213149775068140332673711280407849","135828512999434492930891267983555278498","241350249127067814701362866221686171980","177779560636366666127034809101540003850","152197478608076664667964106698483506712","50083848977967713720128168494421065311","92143741864909365698688683939914378839","9070014001956918802349267926454885025","241538098677971248183426063596097075235","149162172074875983952724662196916544176","268808385400466145735750471300194633789","86761682234567671273305054723608064512","288370572677021256972058280379879771812","322143592481095253756927058930811123431","312167764756968784479236023182757158924","77615451063648536678744357155673731173","167849657019069351214741319664814715863","1648807304651799192753353105310558320","4931457660078875123933724142627772116","246685082652591740634063258715201882036","310376863187731035629146075204098927641","141855146681493202027702342349235040310","262111817193751863210912753735574559365","329858974484592806499488017660867190456","336664297045099243322087274477119624750","126686557755552045277238911164047910345","15371245689754198075948577861884330140","200078792374692183658629107143251669351","39309338669571035316842260161295427153","264639861105915987440257039457822246200","333532169312446570670407561520275093199","238289860730261333733138493356606560239","322987046947222899958158335679663167294","74932609671116400669666316731583086083","229566536813255780498356527334506116508","23019640261355816510934553083107148692","15850485816595364574082599622600501693","112296576229983270732808059213604452014","259795921749393670145027562339229534833","245820013272976626728950651456842512888","171396114388315110249260080941557503694","290986633354063520741075067235432335649","23019640261355816510934553083107148692","151328594815204579035772118854767891652","55055837284510373290791918117690075208","231469408503453425317333168420853493078","195371289381774498222353462516619632151","301335429407761883333083635439920593201","196149714435068397739254756813150953110","23019640261355816510934553083107148692","151328594815204579035772118854767891652","171481463533467523123519669908284093130","138071801504551228399852641251936267627","80351099393504592892472152499197249962","236447964226870811193493000170011016006","326455045852694941000940791205135658751","255425667140474026713171650516520088462","304428447814201500433602347319302929588","295678383926799976356476130420023713850","113987015670683046902348658246288317989","83398866278981922218881775951369730811","12667883101096991226699289385873329997","161617186070707757184292579842203464595","93062584046029778999725006642402107837","275813525654466604211434679012070799015","2943755775956654463201612440838521830","267369876706281586312943206354777301960","178139449053305854097023288926959726199","7254995038451835339383520839823065937","267369876706281586312943206354777301960","187153847463645786230455687773235454703","297424346792636863052847555531470539013","20451508924496899210608959401147021536","121690448188308450039376972339973644788","337656375481724388193606794592315338898","324975264521971048071576019591941200992","325196086053275117915382641241469403936"],"threshold":0.9},"id":"CVE-2026-18300-cf94653b"},{"target":{"file":"libs/ctx/ctx.h","function":"_ctx_rasterizer_reset"},"deprecated":false,"digest":{"function_hash":"236823349024928779940489445758016599892","length":393},"id":"CVE-2026-18300-d37e7f71","signature_type":"Function","signature_version":"v1","source":"https://gitlab.gnome.org/gnome/gegl@d3d262008299341c5b032b354021632ceadb2799"},{"target":{"file":"libs/ctx/ctx.h","function":"ctx_rasterizer_rasterize_edges2"},"deprecated":false,"digest":{"function_hash":"233572476320524092128920045720169417267","length":6946},"id":"CVE-2026-18300-f4cd7b36","signature_type":"Function","signature_version":"v1","source":"https://gitlab.gnome.org/gnome/gegl@d3d262008299341c5b032b354021632ceadb2799"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}