CVE-2026-106062: gimp

Vulnerability summary

CVE-2026-106062 is a high (CVSS 7.8) vulnerability in gimp. EPSS estimates a 0.15% chance of exploitation in the next 30 days, higher than 3.8% of scored vulnerabilities.

Timeline

1. 06-10-2026
   PublishedVulnerability first disclosed.
2. 16-10-2026
   Last modifiedVulnerability information updated.

Description

A heap-based buffer overflow was found in GIMP’s DirectDraw Surface (DDS) loader. When loading a crafted DDS image, buffer sizes derived from width, height, and pitch can be computed using 32-bit arithmetic that overflows. The allocated buffer is too small for the amount of pixel data written through GEGL, following integer overflow in size calculations. This may allow heap corruption and, in the worst case, arbitrary code execution in the context of the GIMP process.

• CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.