CVE-2026-18300
- Source
- https://cve.org/CVERecord?id=CVE-2026-18300
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-18300.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-18300
- Downstream
- Published
- 2026-08-20T16:22:54.633Z
- Modified
- 2026-08-28T08:20:35.528489Z
- Severity
-
- 7.8 (High) CVSS_V3 - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- GIMP HDR File Parsing Integer Overflow Remote Code Execution Vulnerability
- Details
-
GIMP HDR File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of HDR files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29289.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/18xxx/CVE-2026-18300.json", "unresolved_ranges": [ { "source": "AFFECTED_FIELD", "extracted_events": [ { "introduced": "3.2.2" }, { "last_affected": "3.2.2" } ] } ], "cwe_ids": [ "CWE-190" ], "cna_assigner": "zdi" }- References
Affected packages
Git / gitlab.gnome.org/gnome/gegl
Affected versions
Other
GEGL_0_0_14
GEGL_0_0_16
GEGL_0_0_4
GEGL_0_1_0_REAL
GEGL_0_1_2
GEGL_0_1_4
GEGL_0_1_6
GEGL_0_1_8
GEGL_0_2_0
GEGL_0_3_0
GEGL_0_3_10
GEGL_0_3_12
GEGL_0_3_14
GEGL_0_3_16
GEGL_0_3_18
GEGL_0_3_2
GEGL_0_3_20
GEGL_0_3_22
GEGL_0_3_24
GEGL_0_3_26
GEGL_0_3_28
GEGL_0_3_30
GEGL_0_3_34
GEGL_0_3_4
GEGL_0_3_6
GEGL_0_3_8
GEGL_0_4_0
GEGL_0_4_10
GEGL_0_4_12
GEGL_0_4_14
GEGL_0_4_16
GEGL_0_4_18
GEGL_0_4_2
GEGL_0_4_20
GEGL_0_4_24
GEGL_0_4_26
GEGL_0_4_28
GEGL_0_4_30
GEGL_0_4_32
GEGL_0_4_34
GEGL_0_4_36
GEGL_0_4_38
GEGL_0_4_4
GEGL_0_4_40
GEGL_0_4_42
GEGL_0_4_44
GEGL_0_4_46
GEGL_0_4_48
GEGL_0_4_50
GEGL_0_4_52
GEGL_0_4_54
GEGL_0_4_56
GEGL_0_4_58
GEGL_0_4_6
GEGL_0_4_62
GEGL_0_4_64
GEGL_0_4_66
GEGL_0_4_68
GEGL_0_4_70
GEGL_0_4_8
GEGL_20001120_v002
GEGL_BEFORE_CLEANUP
GNOME_PRINT_0_24
Database specific
vanir_signatures
[
{
"id": "CVE-2026-18300-0c1a0e5c",
"target": {
"function": "ctx_rasterizer_reset_soft",
"file": "libs/ctx/ctx.h"
},
"deprecated": false,
"digest": {
"function_hash": "79649320582126362945795237980877824355",
"length": 149.0
},
"signature_version": "v1",
"source": "https://gitlab.gnome.org/gnome/gegl@d3d262008299341c5b032b354021632ceadb2799",
"signature_type": "Function"
},
{
"id": "CVE-2026-18300-126cf169",
"target": {
"function": "ctx_parser_resolve_command",
"file": "libs/ctx/ctx.h"
},
"deprecated": false,
"digest": {
"function_hash": "250190858612639938331878423311540827881",
"length": 11812.0
},
"signature_version": "v1",
"source": "https://gitlab.gnome.org/gnome/gegl@d3d262008299341c5b032b354021632ceadb2799",
"signature_type": "Function"
},
{
"id": "CVE-2026-18300-16ba79f7",
"target": {
"function": "ctx_rasterizer_apply_grads_copy_normal_color",
"file": "libs/ctx/ctx.h"
},
"deprecated": false,
"digest": {
"function_hash": "1998726714039042008933572772693136220",
"length": 1049.0
},
"signature_version": "v1",
"source": "https://gitlab.gnome.org/gnome/gegl@d3d262008299341c5b032b354021632ceadb2799",
"signature_type": "Function"
},
{
"id": "CVE-2026-18300-2c1724aa",
"target": {
"function": "ctx_rasterizer_stroke",
"file": "libs/ctx/ctx.h"
},
"deprecated": false,
"digest": {
"function_hash": "84025211328750890885536817683799036792",
"length": 6320.0
},
"signature_version": "v1",
"source": "https://gitlab.gnome.org/gnome/gegl@d3d262008299341c5b032b354021632ceadb2799",
"signature_type": "Function"
},
{
"id": "CVE-2026-18300-3cda0422",
"target": {
"function": "ctx_rasterizer_feed_edges_full",
"file": "libs/ctx/ctx.h"
},
"deprecated": false,
"digest": {
"function_hash": "292368829887974974512663846395908432191",
"length": 2122.0
},
"signature_version": "v1",
"source": "https://gitlab.gnome.org/gnome/gegl@d3d262008299341c5b032b354021632ceadb2799",
"signature_type": "Function"
},
{
"id": "CVE-2026-18300-50b23c9a",
"target": {
"function": "(ctx_rasterizer_rasterize_edges)",
"file": "libs/ctx/ctx.h"
},
"deprecated": false,
"digest": {
"function_hash": "282432260037277012323408468300669503860",
"length": 497.0
},
"signature_version": "v1",
"source": "https://gitlab.gnome.org/gnome/gegl@d3d262008299341c5b032b354021632ceadb2799",
"signature_type": "Function"
},
{
"id": "CVE-2026-18300-53918da0",
"target": {
"file": "libs/rgbe/rgbe.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"266463162357425861373171312791609802694",
"242462423156929363080939498942731370429",
"205808523917827903013955651059162721081"
]
},
"signature_version": "v1",
"source": "https://gitlab.gnome.org/gnome/gegl@d3d262008299341c5b032b354021632ceadb2799",
"signature_type": "Line"
},
{
"id": "CVE-2026-18300-6b655ac5",
"target": {
"function": "rgbe_read_scanlines",
"file": "libs/rgbe/rgbe.c"
},
"deprecated": false,
"digest": {
"function_hash": "261370790823940205837726566245226840525",
"length": 1041.0
},
"signature_version": "v1",
"source": "https://gitlab.gnome.org/gnome/gegl@d3d262008299341c5b032b354021632ceadb2799",
"signature_type": "Function"
},
{
"id": "CVE-2026-18300-8246341b",
"target": {
"function": "murmur3_32_process",
"file": "libs/ctx/ctx.h"
},
"deprecated": false,
"digest": {
"function_hash": "116595015640255667449086297865628963056",
"length": 537.0
},
"signature_version": "v1",
"source": "https://gitlab.gnome.org/gnome/gegl@d3d262008299341c5b032b354021632ceadb2799",
"signature_type": "Function"
},
{
"id": "CVE-2026-18300-abbbf8b1",
"target": {
"function": "ctx_sdf_f",
"file": "libs/ctx/ctx.h"
},
"deprecated": false,
"digest": {
"function_hash": "236413250744008101976752065795489651891",
"length": 591.0
},
"signature_version": "v1",
"source": "https://gitlab.gnome.org/gnome/gegl@d3d262008299341c5b032b354021632ceadb2799",
"signature_type": "Function"
},
{
"id": "CVE-2026-18300-beff7f5a",
"target": {
"function": "ctx_rasterizer_generate_sdf",
"file": "libs/ctx/ctx.h"
},
"deprecated": false,
"digest": {
"function_hash": "55997818653246000227805453912740877853",
"length": 2640.0
},
"signature_version": "v1",
"source": "https://gitlab.gnome.org/gnome/gegl@d3d262008299341c5b032b354021632ceadb2799",
"signature_type": "Function"
},
{
"id": "CVE-2026-18300-c7853a37",
"target": {
"function": "ctx_rasterizer_apply_grads",
"file": "libs/ctx/ctx.h"
},
"deprecated": false,
"digest": {
"function_hash": "40304768293265175971448406005435864741",
"length": 1148.0
},
"signature_version": "v1",
"source": "https://gitlab.gnome.org/gnome/gegl@d3d262008299341c5b032b354021632ceadb2799",
"signature_type": "Function"
},
{
"id": "CVE-2026-18300-cf896347",
"target": {
"function": "ctx_resource_parse_header",
"file": "libs/ctx/ctx.h"
},
"deprecated": false,
"digest": {
"function_hash": "123387608236043539189609620415943331817",
"length": 2682.0
},
"signature_version": "v1",
"source": "https://gitlab.gnome.org/gnome/gegl@d3d262008299341c5b032b354021632ceadb2799",
"signature_type": "Function"
},
{
"id": "CVE-2026-18300-cf94653b",
"target": {
"file": "libs/ctx/ctx.h"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"66139364987982132262718316079925286945",
"44773390025657646301412073154639114983",
"23989684052785147662963464642718875877",
"248052415007915164210847347031507508480",
"68043729071588014395995685615774178174",
"166842938360666995563276286400736545039",
"149956623699120189791599864391711591780",
"108428465458487927689431676398856922821",
"221820026010913151603100991640198327911",
"32165677391397961348931333431392993580",
"187707478053279084915514845959161772363",
"122626249402403096112369710746455729241",
"203040560124978924929995076636488645820",
"39709231241224552715687187858518827310",
"190657831018940776776455800935981425243",
"329929381269096627468654132267430480954",
"154140627960171132454768340394310739650",
"207038047540191601251554724726781999879",
"231215981816253772958156996484779788593",
"151598510897301183398076980622984561849",
"178114590517030734436360510985109302173",
"3872281256907311312569535414039460090",
"302434721229685253806785356670872236813",
"292153574983140643052381776555220972988",
"90919270651494254735063269298848694573",
"141923858833236821924422058283802121249",
"174251526991668954007593788694757902598",
"260595268798975705143634972017952206395",
"150135537464509055995257410917245644226",
"335294772342423685792512194825917972334",
"86578460348544600571651977714958037152",
"245613806520789798157037812831468597088",
"173787903752997195867388825081902484605",
"315858938016000637722041988385751446508",
"5631466248233001743345366294019100061",
"222815151545247945775457709223077878582",
"27731420353282191879494448522954567752",
"186528891158708330618616814785118095492",
"272920302236534858060410069283093630244",
"268079982270111600871913143962943647664",
"2656469635901152070838919551683784725",
"139356447164737550385363133221339960347",
"333403444939460391954277306687400605827",
"315907082694700564357748517241007511723",
"7125763408624919490682887346556555937",
"4887339775892997648369447703724373015",
"237328512814111709605566875412594705315",
"299259817472724934167555512983421260961",
"118751911283032465457936515221882120469",
"149415202282226288091511489778323403342",
"35779107056603137405232243721236863324",
"114937391690106546490072885964533919091",
"175431299464752204688194095602733014028",
"108707889860172415966318834939250363398",
"68987605020062215654129904715510228924",
"94323653783536482594121922566275250742",
"215505298229024459676124492459568128129",
"90241774863664765821062859936877126054",
"3604292317831830657096713856499495544",
"45436917486192854264252331618568372993",
"229707259796040262434116392136965326812",
"34837328184294269105060517248236212714",
"13948861639333207330452788154306482054",
"198783354886804153255426578298709123653",
"93036080573460559206018189721696525812",
"149988699892859040535150257963545130481",
"97871522800527568629772856700651819420",
"92487289383717305172859796589068430279",
"132801896095493958760319007722498267776",
"143121028635386153840562781619946448449",
"200790515574559652042261835183687288822",
"272776195817756400882838708228411850190",
"303790820548799466302975393982553668935",
"251254456616962565846980412241802468708",
"170200503406110425173143382645618862754",
"297184621465900351545830391737714600066",
"259270568209534398182055892703120024986",
"280950969565540019406653175289525489461",
"66335873919007219147329997253300133116",
"16271041805414098789958239271873690018",
"312593878917217815657640978454126687968",
"12645365244437732184068435759667669859",
"290041959371689948938092450832743482649",
"254770799546577071557013082855318440186",
"106380883033000803064786187487029903214",
"229815290283193398186931028304024080926",
"270562580328376875467856373610637575612",
"244554180196961599634298305668803429199",
"227986561302884482924586127368175890930",
"44174853812505253791539077388467542758",
"262897992460119572150495711664025888390",
"92434949600898320863787357498786170383",
"154525721538665222393439929794796036735",
"337818749512463906057602995734803337330",
"337527852762280528724643718917917327066",
"134477929264928753046231640636733928692",
"293449684063959927333867182988097602918",
"140319486033925985601160217213976411591",
"64949049469795578463119748957596453319",
"286983658883908574230072205747976986628",
"64281539714770542143847068081305336752",
"205706836667122642948404808528558014737",
"68988890286708098534135385000279479705",
"230504152136282820199838626185965780783",
"183638129429618219658550831756046533570",
"245844766945535427564825914271194533217",
"52229277134773664782484270812955982413",
"145258640859764967244255268030608906622",
"15284253123827457213200958995007004947",
"137433246497702215390365582090309331435",
"39015248424609681248612015853094462988",
"263995078104823293393351566573198502949",
"206229437232814485172138009902571650271",
"129006856209752837018664493108248598402",
"322840924340054905726003706478654616074",
"275383984000464938614553847188782690745",
"81927816863808729242630951616368693267",
"20749026420338878622124843132869906973",
"136553485122110146521032808691645455436",
"175083719942568039576293611413684574365",
"267093890280189384002805189884795275790",
"276739993748872323644296280564114668161",
"106024216488677406869685792434105467548",
"14291194462589827004130454279431428327",
"185855327050180833629928529904923644906",
"282451338009799640502783526918272798155",
"179485762181817347738986050733422362790",
"23404779044869889592029508451800069368",
"240171847253270283168378509747452333983",
"41626170312730415376357276065856860833",
"170560529410964180438800832863400528879",
"154387851518524088791945437217417788124",
"21880843891606152897215442247764771797",
"325149318946001276301338314630161669701",
"127171712237156355316113341646323329719",
"49371855135561680033106920785866080938",
"340186569762020579207747277492341222062",
"308718928594415221941124502024370181565",
"239755455827641077825562608382307925533",
"300052847597405949384889707727551110245",
"189852781502489999013340011678767789243",
"147376667830430769590519605318060153082",
"290302269849428197444521552078896322374",
"84344139562617142119835550784275870260",
"274781860243044981830762025695255097408",
"92504673357391402152117761403958066591",
"324034635706819006664718186698117341729",
"23180713033450463472126435272412366472",
"17764180765588649941284347203243006585",
"12699465205246959862961260120529443303",
"126554417211313179994735160444459249542",
"318852950069726356941626324297210864478",
"56056109709314589895187410124303417483",
"21967884787533232357867428817145923984",
"141787716127235378851968519414296676832",
"235572847447523347001796689272751135493",
"61711269178148418858118796770799658191",
"244968773248595731777353526995289220136",
"250314992649459845097358645898903426398",
"221283109643586068145475464808989159783",
"43545971540011557269335972613577818043",
"333418522672248978301139821905949572838",
"100396886373752253806315336995688355093",
"86070439530126372775779829258839233666",
"124827445337716773937775168575601038675",
"67260163349346432746738850927954029357",
"188625576562150313844642101365637146415",
"134866117434994538008630879798870491427",
"47196016733896043758446044377372755021",
"299682830901623604236497716549431744572",
"196219096830457726827160056027908049252",
"250766971716226830940210028700295642870",
"208137613827960368001396399805720763069",
"160422130547184298596136491690724486255",
"36205613088430450253610672475614852864",
"9123004540499443411164876742242787469",
"308563681584032869195633604500532556682",
"188910304286979224552803676191583381242",
"286648568209023141030639918207333844990",
"56216320152572903499888735140631823133",
"37919387230069408347839209680460604037",
"134866117434994538008630879798870491427",
"208137613827960368001396399805720763069",
"160422130547184298596136491690724486255",
"36205613088430450253610672475614852864",
"108543512479273723698709802658819054697",
"306616412575211213464052955650978919295",
"90409891843155239117827273928275259907",
"22049140284371128150803111979927140296",
"266664146939374994873457409287677572118",
"79054056677691289097457461677196763240",
"98981738036981454130489800803428770702",
"132178385718729517646322002985651868271",
"194277536163287696499714295502441683767",
"329390127157173080596245446547295959339",
"201181755767168587972635787534135607360",
"125043105688787457775678610087959219417",
"83541926291600218894788078598019818102",
"272215196216823095205300029407214108020",
"2525328919904064845561983452212232166",
"30787071934066398974457107267171494149",
"312526821068139056082143661776257536390",
"300477505279326446625976077994637225042",
"27446008114575336800417939039656792750",
"321484000655911103306254704653164601509",
"109328131540031910785407409696675499226",
"248228568665687034387634756253869767036",
"237395279759984387437236146753724961979",
"80000472007800600229772975115379075543",
"44248490118073142226370624247758119243",
"103819628791665526633610284636750431607",
"141230743584809453674387377144409492815",
"181626206778978768886056257099581558276",
"313996024886968239059750741601209519743",
"148486103642747406226207658373894690264",
"163042690603860275146959627023601106441",
"160287383906165028127293540302605008890",
"305466637200345828148532772644738056014",
"136494243225461068722527220213495956879",
"259055424106266885052229197229679871670",
"63891587590952240844833074659153823527",
"120667700372556630328020781824216530820",
"16256964363104877200356972292413515644",
"213128196843855572101241534523484789972",
"31312482337973980101421333126181275475",
"261319092766835017905963144088008495943",
"250423567161591071571647960489876485726",
"157188734386369612250492306512558979485",
"96086333391986752157139590790778625289",
"263494351430320208697214815245603406626",
"31312482337973980101421333126181275475",
"261319092766835017905963144088008495943",
"116987177100282648937277913990790130648",
"210530853898597227484091807671347915842",
"67374979608197105118138628575962028029",
"278834470942120570925047586399909224048",
"157774465766169249515938366843956673361",
"198106894331842409571741165742308696668",
"11517593893850956083684687873540924002",
"176740273144520644589237081288988464263",
"301285515300001580711965240751003845270",
"230386553093310469879887817435731208457",
"323703265906817181404866305953168189931",
"218672408837447537555230301833339685854",
"267493647693810325336201315629383130961",
"251925054729110886538725390727427307533",
"284927337112556666836084006578458938385",
"155297486948153905712967046271289135943",
"222829971984558487828447241963759340946",
"78547472005737657485535396944033338152",
"291445958996223817440585096079557814028",
"283299934071877758249250257294506002525",
"216252413355031061840267060153851918327",
"317562390672567248588651695862557177714",
"126775668653795804160930509792596984640",
"73647564894741911828031990990447778967",
"180380326542452844205570486214201096800",
"295987738109493526541647014665974242752",
"145408069838851387159724804873993187474",
"231742975312950004818029520600446531267",
"334231435225663197092487198376603382020",
"160621955926753304436931973413265281116",
"310297969314043520022442792022374447304",
"256765225178188278738853059237945307582",
"182499162923805888030874908037470956671",
"110898262665719244537520139468509205454",
"186300038197199291607940504251885802733",
"16407650528552099210774189616233996441",
"91778625776558829591432683384940898688",
"224684776366420406655352146465983104328",
"99363081465689216245193829251601116973",
"113316140889270938371765759312810621698",
"308231268049115843789762792692383158628",
"218908958712996284609428046714977123570",
"300062146032689910395660902181827070447",
"329468515387561612885953612342586382931",
"305976899537191921085458209752967767091",
"155471912789216776072644889262754673858",
"321133213149775068140332673711280407849",
"135828512999434492930891267983555278498",
"241350249127067814701362866221686171980",
"177779560636366666127034809101540003850",
"152197478608076664667964106698483506712",
"50083848977967713720128168494421065311",
"92143741864909365698688683939914378839",
"9070014001956918802349267926454885025",
"241538098677971248183426063596097075235",
"149162172074875983952724662196916544176",
"268808385400466145735750471300194633789",
"86761682234567671273305054723608064512",
"288370572677021256972058280379879771812",
"322143592481095253756927058930811123431",
"312167764756968784479236023182757158924",
"77615451063648536678744357155673731173",
"167849657019069351214741319664814715863",
"1648807304651799192753353105310558320",
"4931457660078875123933724142627772116",
"246685082652591740634063258715201882036",
"310376863187731035629146075204098927641",
"141855146681493202027702342349235040310",
"262111817193751863210912753735574559365",
"329858974484592806499488017660867190456",
"336664297045099243322087274477119624750",
"126686557755552045277238911164047910345",
"15371245689754198075948577861884330140",
"200078792374692183658629107143251669351",
"39309338669571035316842260161295427153",
"264639861105915987440257039457822246200",
"333532169312446570670407561520275093199",
"238289860730261333733138493356606560239",
"322987046947222899958158335679663167294",
"74932609671116400669666316731583086083",
"229566536813255780498356527334506116508",
"23019640261355816510934553083107148692",
"15850485816595364574082599622600501693",
"112296576229983270732808059213604452014",
"259795921749393670145027562339229534833",
"245820013272976626728950651456842512888",
"171396114388315110249260080941557503694",
"290986633354063520741075067235432335649",
"23019640261355816510934553083107148692",
"151328594815204579035772118854767891652",
"55055837284510373290791918117690075208",
"231469408503453425317333168420853493078",
"195371289381774498222353462516619632151",
"301335429407761883333083635439920593201",
"196149714435068397739254756813150953110",
"23019640261355816510934553083107148692",
"151328594815204579035772118854767891652",
"171481463533467523123519669908284093130",
"138071801504551228399852641251936267627",
"80351099393504592892472152499197249962",
"236447964226870811193493000170011016006",
"326455045852694941000940791205135658751",
"255425667140474026713171650516520088462",
"304428447814201500433602347319302929588",
"295678383926799976356476130420023713850",
"113987015670683046902348658246288317989",
"83398866278981922218881775951369730811",
"12667883101096991226699289385873329997",
"161617186070707757184292579842203464595",
"93062584046029778999725006642402107837",
"275813525654466604211434679012070799015",
"2943755775956654463201612440838521830",
"267369876706281586312943206354777301960",
"178139449053305854097023288926959726199",
"7254995038451835339383520839823065937",
"267369876706281586312943206354777301960",
"187153847463645786230455687773235454703",
"297424346792636863052847555531470539013",
"20451508924496899210608959401147021536",
"121690448188308450039376972339973644788",
"337656375481724388193606794592315338898",
"324975264521971048071576019591941200992",
"325196086053275117915382641241469403936"
]
},
"signature_version": "v1",
"source": "https://gitlab.gnome.org/gnome/gegl@d3d262008299341c5b032b354021632ceadb2799",
"signature_type": "Line"
},
{
"id": "CVE-2026-18300-d37e7f71",
"target": {
"function": "_ctx_rasterizer_reset",
"file": "libs/ctx/ctx.h"
},
"deprecated": false,
"digest": {
"function_hash": "236823349024928779940489445758016599892",
"length": 393.0
},
"signature_version": "v1",
"source": "https://gitlab.gnome.org/gnome/gegl@d3d262008299341c5b032b354021632ceadb2799",
"signature_type": "Function"
},
{
"id": "CVE-2026-18300-f4cd7b36",
"target": {
"function": "ctx_rasterizer_rasterize_edges2",
"file": "libs/ctx/ctx.h"
},
"deprecated": false,
"digest": {
"function_hash": "233572476320524092128920045720169417267",
"length": 6946.0
},
"signature_version": "v1",
"source": "https://gitlab.gnome.org/gnome/gegl@d3d262008299341c5b032b354021632ceadb2799",
"signature_type": "Function"
}
]
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-18300.json"
vanir_signatures_modified
"2026-08-28T08:20:35Z"