CVE-2026-106064
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
A heap-based buffer overflow exists in GIMP's GIF export plug-in. Exporting an image with very large width and height can cause a 32-bit overflow when computing the pixel buffer size, leading to an integer overflow and a mismatch between allocation and actual write by GEGL.
Risk Assessment
This could lead to memory corruption, application crash, or potential arbitrary code execution in the context of the GIMP process. The risk occurs when exporting a specially crafted image.
Recommendation
Update GIMP to a version containing the fix for this issue. Avoid exporting images with extremely large dimensions from untrusted sources.
Other vulnerabilities in GIMP
See all- CVE-2017-17789High
In GIMP 2.8.22, there is a heap-based buffer overflow in read_channel_data in plug-ins/common/file-psp.c.
- CVE-2017-17787High
In GIMP 2.8.22, there is a heap-based buffer over-read in the read_creator_block handler in plug-ins/common/file-psp.c.
- CVE-2017-17786High
In GIMP 2.8.22, there is a heap-based buffer over-read in ReadImage in plug-ins/common/file-tga.c, related to an unexpected bits-per-pixel value for an RGBA image.
- CVE-2017-17785High
In GIMP 2.8.22, there is a heap-based buffer overflow in the fli_read_brun function in plug-ins/file-fli/fli.c.
- CVE-2017-17784High
In GIMP 2.8.22, there is a heap-based buffer over-read in load_image in plug-ins/common/file-gbr.c, related to mishandling of UTF-8 data.
- CVE-2016-4994High
A use-after-free vulnerability in the xcf_load_image function in xcf-load.c in GIMP allows remote attackers to cause a denial of service (program crash) or possibly execute arbitrary code via a crafted XCF file.
- CVE-2026-106067Medium
A heap-based buffer overflow was found in GIMP’s Hot color filter plug-in. For very large images, a pixel buffer is allocated using overflowing 32-bit width * height (and related) arithmetic while the filter’s pixel access path uses the true image size, after integer overflow in the allocation size.
- CVE-2026-106066Medium
GIMP's raw data export plug-in contains a heap-based buffer overflow. When exporting very large images, sizing based on overflowing width * height * bytes-per-pixel can allocate far less memory than GEGL reads or writes during export, leading to a buffer overflow.
- CVE-2026-106065Medium
A heap-based buffer overflow was found in GIMP's PCX export plug-in. For images with extremely large width and height, buffer allocation uses overflowing 32-bit width * height arithmetic while subsequent GEGL operations use the full extent, after integer overflow in size calculation.
- CVE-2026-106061Medium
A flaw was found in GIMP's X cursor (XMC) thumbnail loader. When generating a thumbnail for a crafted XMC file, a pixel buffer is allocated using a width * height size computed in 32-bit signed arithmetic, which can overflow and lead to an out-of-bounds read on the heap.
Original NVD description (English source)
A heap-based buffer overflow was found in GIMP’s GIF export plug-in. Exporting an image with very large width and height can cause 32-bit overflow when computing the pixel buffer size. The plug-in allocates a buffer based on the wrapped value while GEGL writes using the true image extent, rooted in integer overflow
Vulnerability data from NVD (NIST) · CISA KEV · EPSS