CVE-2026-92183: GIMP APNG Stack Buffer Overflow (ZDI-26-713) — Detection and Remediation Guide

---
title: GIMP Process Spawning Suspicious Child Process
tid: 9c2e7a41-3d6b-4f85-b1a9-7e5d2c8f4091
status: experimental
description: Detects GIMP (gimp.exe, gimp-2.99.exe, or Linux gimp binary) spawning a shell, script interpreter, or other unusual child process — a strong indicator of successful exploitation of a file-parsing vulnerability such as CVE-2026-92183 (ZDI-26-713, APNG stack buffer overflow).
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-713/
  - https://attack.mitre.org/techniques/T1203/
  - https://attack.mitre.org/techniques/T1204.002/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1203
  - attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\gimp.exe'
      - '\gimp-2.99.exe'
      - '\gimp-2.10.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\wmic.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\curl.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Extremely rare; GIMP script-fu batch operations may invoke external tools in unusual workflows
level: high
---
title: Suspicious APNG File Written to Download or Temp Locations
tid: 4f1b8c72-6a3d-4e29-9c5f-2b7a1d3e8096
status: experimental
description: Detects creation of APNG/PNG image files in user download, temp, or email attachment cache locations around potential phishing delivery — a triage pivot for hunting CVE-2026-92183 delivery attempts.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-713/
  - https://attack.mitre.org/techniques/T1204.002/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1204.002
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\Downloads\'
      - '\AppData\Local\Temp\'
      - '\AppData\Local\Microsoft\Windows\INetCache\'
      - '\Content.Outlook\'
  selection_ext:
    TargetFilename|endswith:
      - '.apng'
  condition: selection_path and selection_ext
falsepositives:
  - Legitimate download of animated PNG assets by designers; tune by correlating with email/web proxy telemetry
level: medium

// Hunt 1: GIMP spawning child processes (post-exploitation indicator)
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ ("gimp.exe", "gimp-2.99.exe", "gimp-2.10.exe", "gimp")
| where FileName !in~ ("gimp.exe", "gimp-2.99.exe", "gimp-2.10.exe")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName,
    InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256
| order by TimeGenerated desc;

// Hunt 2: APNG file delivery into user-controlled locations
DeviceFileEvents
| where TimeGenerated > ago(14d)
| where FileName endswith ".apng"
| where FolderPath has_any ("\\Downloads\\", "\\Temp\\", "INetCache", "Content.Outlook")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FolderPath,
    FileName, SHA256, InitiatingProcessAccountName
| order by TimeGenerated desc;

// Hunt 3: GIMP process crash events via Windows Error Reporting (Sysmon/SecurityEvent ingestion)
Event
| where TimeGenerated > ago(14d)
| where EventLog == "Application" and Source == "Application Error"
| where EventData has_any ("gimp.exe", "gimp-2.99.exe", "gimp-2.10.exe")
| project TimeGenerated, Computer, EventData
| order by TimeGenerated desc

-- CVE-2026-92183 triage: GIMP processes, child processes, and APNG artifacts
LET procs = SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()

LET gimp_procs = SELECT * FROM procs
WHERE Name =~ '(?i)gimp'

LET gimp_children = SELECT child.Pid AS Pid, child.Name AS Name,
  child.CommandLine AS CommandLine, child.Exe AS Exe,
  child.Username AS Username, child.CreateTime AS CreateTime,
  parent.Name AS ParentName, parent.Pid AS ParentPid
FROM procs AS child
JOIN gimp_procs AS parent
ON child.Ppid = parent.Pid

LET apng_files = SELECT FullPath, Size, Mtime, Atime, Ctime
FROM glob(globs=[
  'C:/Users/*/Downloads/**/*.apng',
  'C:/Users/*/AppData/Local/Temp/**/*.apng',
  '/home/*/Downloads/**/*.apng',
  '/tmp/**/*.apng'
])

SELECT * FROM gimp_children
UNION ALL
SELECT NULL AS Pid, 'APNG_ARTIFACT' AS Name, FullPath AS CommandLine,
  '' AS Exe, '' AS Username, Mtime AS CreateTime,
  '' AS ParentName, NULL AS ParentPid
FROM apng_files

# CVE-2026-92183 (ZDI-26-713) - GIMP APNG buffer overflow inventory & mitigation check
# Run elevated. Audits GIMP installs and reports patch status.

$results = @()

# 1. Locate GIMP installations (registry uninstall keys + common paths)
$uninstallPaths = @(
  'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
  'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
)
$gimpApps = Get-ItemProperty $uninstallPaths -ErrorAction SilentlyContinue |
  Where-Object { $_.DisplayName -match 'GIMP' } |
  Select-Object DisplayName, DisplayVersion, InstallLocation

foreach ($app in $gimpApps) {
  $results += [PSCustomObject]@{
    Product        = $app.DisplayName
    Version        = $app.DisplayVersion
    InstallPath    = $app.InstallLocation
    Status         = 'REVIEW - Verify against patched GIMP release for CVE-2026-92183'
  }
}

# 2. Check for portable/standalone installs outside the registry
$commonPaths = @("$env:ProgramFiles\GIMP*", "${env:ProgramFiles(x86)}\GIMP*", "$env:LOCALAPPDATA\Programs\GIMP*")
foreach ($p in $commonPaths) {
  Get-ChildItem $p -Recurse -Filter 'gimp*.exe' -ErrorAction SilentlyContinue |
    ForEach-Object {
      $results += [PSCustomObject]@{
        Product     = 'GIMP (standalone/portable)'
        Version     = $_.VersionInfo.ProductVersion
        InstallPath = $_.DirectoryName
        Status      = 'REVIEW - unmanaged install detected'
      }
    }
}

# 3. Mitigation (stopgap): rename the APNG plug-in so malicious files cannot be parsed
# Only apply if patching is not immediately possible; this disables APNG support.
$apngPlugins = Get-ChildItem "$env:ProgramFiles\GIMP*" -Recurse -Filter 'file-apng*' -ErrorAction SilentlyContinue
foreach ($plugin in $apngPlugins) {
  Write-Warning "APNG plugin found: $($plugin.FullName)"
  # Uncomment to disable as a stopgap:
  # Rename-Item $plugin.FullName ($plugin.FullName + '.disabled') -Force
}

if ($results.Count -eq 0) { Write-Host '[+] No GIMP installations detected on this host.' }
else { $results | Format-Table -AutoSize }

#!/bin/bash
# CVE-2026-92183 - GIMP inventory and APNG plugin check (Linux)
# Run with sudo for complete package visibility.

echo "=== GIMP package inventory ==="
if command -v dpkg &>/dev/null; then
  dpkg -l | grep -i gimp || echo "No GIMP packages found (dpkg)"
elif command -v rpm &>/dev/null; then
  rpm -qa | grep -i gimp || echo "No GIMP packages found (rpm)"
fi

if command -v flatpak &>/dev/null; then
  echo "=== Flatpak installs ==="
  flatpak list | grep -i gimp || echo "No GIMP Flatpak found"
fi

if command -v snap &>/dev/null; then
  echo "=== Snap installs ==="
  snap list 2>/dev/null | grep -i gimp || echo "No GIMP Snap found"
fi

echo "=== APNG plugin locations ==="
find /usr/lib/gimp /usr/lib64/gimp /usr/share/gimp ~/.config/GIMP -name '*apng*' 2>/dev/null

echo ""
echo "ACTION: Update GIMP via your package manager to the release containing the"
echo "CVE-2026-92183 fix (e.g., apt update && apt upgrade gimp, or flatpak update)."
echo "Stopgap: remove/rename the file-apng plugin until patched."