CVE-2026-66759

A flaw was found in the file-icns plugin in GIMP. When applying a decompressed mask during ICNS image processing, the plugin reads from the mask data buffer without verifying if the cursor exceeds the allocated resource size. If a crafted file contains a truncated mask resource, the icns_decompress function continues reading past the bounds of the buffer. This out-of-bounds read vulnerability results in information disclosure of heap contents, where memory contents are leaked as alpha channel pixel values, or a crash leading to a denial of service if unmapped memory is accessed.

• CWE-125

• https://access.redhat.com/errata/RHSA-2026:50817Issue Tracking
• https://access.redhat.com/security/cve/CVE-2026-66759Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2507557Issue Tracking, Vendor Advisory
• https://gitlab.gnome.org/GNOME/gimp/-/issues/16528Exploit, Issue Tracking, Vendor Advisory
• https://gitlab.gnome.org/GNOME/gimp/-/issues/16528Exploit, Issue Tracking, Vendor Advisory

Published

Jul 27, 2026

Last Modified

Aug 7, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-66753tiny-http through 0.12.0 contains an HTTP header injection v…6.3
• CVE-2026-66754Rouille 0.1.6 through 3.6.2 contains a reachable assertion v…8.2
• CVE-2026-66755Relative Path Traversal in the ISA-Tab parser in Apache Soft…7.5
• CVE-2026-66756Improper Protection of Alternate Path vulnerability in Apach…9.8
• CVE-2026-66757A flaw was found in the file-sgi plugin in GIMP. When proces…5.5
• CVE-2026-66758A flaw was found in the file-fits plugin in GIMP. When proce…7.8
• CVE-2026-6676Heap buffer out-of-bounds write vulnerability in Avira Antiv…7.8
• CVE-2026-66760SAP Approuter does not correctly validate client certificate…6.4
• CVE-2026-66761SAP Approuter does not enforce sufficient flow control in ce…4.3
• CVE-2026-66763SAP BusinessObjects Business Intelligence Platform stores ce…7.9
• CVE-2026-66764Reprocess Bank Statement Items in SAP S/4HANA does not perfo…4.3
• CVE-2026-66770Due to an SQL Injection vulnerability in SAP Social intellig…6.3