CVE-2026-6695 Gimp: gimp: remote code execution via crafted paa file
A remote attacker can execute arbitrary code by tricking a user into opening a malicious PAA image file, causing a heap-based out-of-bounds write.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-6695?
CVE-2026-6695 is a medium-severity memory corruption vulnerability in Gimp Gimp, published on 3 Aug 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A flaw was found in GIMP. A remote attacker could exploit this by tricking a user into opening a specially crafted PAA (Paint Shop Pro Array) image file. This vulnerability, a heap-based out-of-bounds write in the decode_lzss() function of the PAA file format plugin, allows data to be written beyond the intended memory buffer. This could lead to heap metadata corruption and potentially enable the attacker to execute arbitrary code on the affected system.
Weakness: CWE-805
Which versions are affected by CVE-2026-6695?
It affects 2 products.
Products include Gimp Gimp, Redhat Enterprise Linux.
How do I fix CVE-2026-6695?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-6695 being exploited?
There is no known exploitation of CVE-2026-6695 in the wild and no public exploit code.
Other vulnerabilities in Gimp Gimp
Sources
Also known as DEBIAN-CVE-2026-6695, GHSA-hhpf-5jpm-6q9g, UBUNTU-CVE-2026-6695.