CVE-2026-2049: GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

Synopsis

A heap-based buffer overflow exists in GIMP's HDR file parser. The flaw is triggered locally when a user opens a maliciously crafted HDR image file, requiring no authentication but needing the user to interact with the file. Successful exploitation gives the attacker full code execution in the context of the running GIMP process, enabling complete compromise of confidentiality, integrity, and availability. No upstream fix has been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as a fix version is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker does not need direct network access to the host; they need an existing shell or process on the host, or must deliver a malicious HDR file through another channel such as email or a web download.

• AuthenticationNot required

  No account or credentials on the target system are required; the attacker only needs to get the victim to open a crafted file.

• Victim interactionRequired

  The target user must actively open a malicious HDR file or visit a page that triggers GIMP to parse one, making social engineering a necessary part of the attack chain.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental variables beyond getting the victim to open the file.

Blast Radius

• The attacker executes arbitrary code in the context of the GIMP process, gaining the same filesystem and network permissions as the logged-in user.
• Files accessible to the running user, including documents, credentials, and SSH keys, can be read or exfiltrated.
• The attacker can write or modify files owned by the current user, including configuration files and scripts that may affect other processes.
• The GIMP process and any dependent workflows are crashed or hijacked, disrupting image-processing pipelines or automation that relies on GIMP.