CVE-2026-66757

A flaw was found in the file-sgi plugin in GIMP. When processing an RLE-compressed SGI image, the plugin allocates memory for a row table. The image header dimensions (ysize and zsize) are read as 16-bit unsigned integers. If a crafted file sets both dimensions to their maximum value (65535), the multiplication ysize * zsize overflows the standard 32-bit int boundary before being passed to calloc. This integer overflow issue results in undefined behavior, aborting the plugin and causing a denial of service.

• CWE-190

• https://access.redhat.com/security/cve/CVE-2026-66757Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2507465Issue Tracking, Vendor Advisory
• https://gitlab.gnome.org/GNOME/gimp/-/work_items/16494Exploit, Issue Tracking, Vendor Advisory
• https://gitlab.gnome.org/GNOME/gimp/-/work_items/16494Exploit, Issue Tracking, Vendor Advisory

Published

Jul 27, 2026

Last Modified

Aug 10, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-66751Let's Chat 0.3.0 through 0.4.8 contains an improper authoriz…5.4
• CVE-2026-66752tiny-http through 0.12.0 contains an HTTP request smuggling …6.3
• CVE-2026-66753tiny-http through 0.12.0 contains an HTTP header injection v…6.3
• CVE-2026-66754Rouille 0.1.6 through 3.6.2 contains a reachable assertion v…8.2
• CVE-2026-66755Relative Path Traversal in the ISA-Tab parser in Apache Soft…7.5
• CVE-2026-66756Improper Protection of Alternate Path vulnerability in Apach…9.8
• CVE-2026-66758A flaw was found in the file-fits plugin in GIMP. When proce…7.8
• CVE-2026-66759A flaw was found in the file-icns plugin in GIMP. When apply…7.1
• CVE-2026-6676Heap buffer out-of-bounds write vulnerability in Avira Antiv…7.8
• CVE-2026-66760SAP Approuter does not correctly validate client certificate…6.4
• CVE-2026-66761SAP Approuter does not enforce sufficient flow control in ce…4.3
• CVE-2026-66763SAP BusinessObjects Business Intelligence Platform stores ce…7.9