CVE-2026-92183: Critical RCE Flaw in GIMP

CVE-2026-92183 is a stack-based buffer overflow vulnerability in GIMP's APNG file parsing component. GIMP is a widely-used open-source graphics editing software. The flaw allows arbitrary remote code execution when a user opens a malicious APNG file or visits a page hosting it. GIMP is extensively deployed in professional environments (designers, photographers, publishers) and personal use. The vulnerability has been tracked by security researchers as ZDI-CAN-29400.

No official CVSS score is available. However, the vulnerability's nature—Remote Code Execution—indicates high severity. The attack vector requires user interaction, limiting worm-like propagation potential. The CVE was published by NVD on October 21, 2026. On November 4, 2026, a GitHub repository signaling exploit-related information was detected, confirming the flaw has been translated into practical attack code.

Administrators must monitor official GIMP advisories for security patches, which represent the definitive remedy. Until patches are available, educate users on risks of opening APNG files from unknown or unverified sources. If feasible, limit GIMP usage to specific users and controlled configurations. Evaluate whether APNG parsing can be disabled via local configuration. Plan priority GIMP update within your patch management cycle.