Vulnerability Spotlight: Two remote code execution vulnerabilities in Xcftools
Summary: Cisco Talos disclosed two remote code execution vulnerabilities in xcftools 1.0.7, both integer overflows in the flattenIncrementally function of the xcf2png and xcf2pnm binaries that can corrupt memory and execute arbitrary code when a victim opens a specially crafted XCF file. Talos released the advisories after xcftools failed to patch the bugs within Cisco's 90-day deadline.
What you should know: The flaws are triggered by opening an XCF file, so anyone who converts GIMP files with xcftools 1.0.7 is exposed, and the vendor let the 90-day disclosure deadline pass without a patch.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2019-5087
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026