LiveThreat Vulnerability Brief — CVE‑2026‑2047
What It Is — A heap‑based buffer overflow in GIMP’s ICNS file parser allows an attacker to execute arbitrary code after a user opens a crafted ICNS file or visits a malicious page that triggers the file load. The flaw scores 7.8 (CVSS 3.1) and requires user interaction; no public exploit has been observed, but a proof‑of‑concept was disclosed with the advisory. Exploitability — PoC available, no known wild exploitation.
Affected Products — GIMP (GNU Image Manipulation Program) – all versions prior to the February 2026 security update.
TPRM Impact — Organizations that embed GIMP in internal tools, rely on Linux distributions shipping GIMP, or allow employees to install third‑party graphics software face a supply‑chain risk: a malicious ICNS file could compromise a workstation and pivot to corporate networks.
Recommended Actions — 1) Deploy the GIMP update released on 2026‑02‑19 that fixes CVE‑2026‑2047. 2) Enforce application whitelisting or block ICNS file handling where not required. 3) Conduct user awareness training on opening unknown image files. 4) Monitor endpoint logs for GIMP crashes or unexpected process launches. Source: Zero Day Initiative Advisory ZDI‑26‑120