What’s Vulnerable › Vulnerabilities

CVE-2026-106062: Gimp: gimp: heap buffer overflow in dds loader on crafted directdraw surface file

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-06 · updated 2026-10-16
• Weakness: CWE-119

Description

A heap-based buffer overflow was found in GIMP’s DirectDraw Surface (DDS) loader. When loading a crafted DDS image, buffer sizes derived from width, height, and pitch can be computed using 32-bit arithmetic that overflows. The allocated buffer is too small for the amount of pixel data written through GEGL, following integer overflow in size calculations. This may allow heap corruption and, in the worst case, arbitrary code execution in the context of the GIMP process.

Affected products

• Red Hat Enterprise Linux 9: all versions

References

• https://access.redhat.com/security/cve/CVE-2026-106062
• https://bugzilla.redhat.com/show_bug.cgi?id=2546654

Get alerted when CVE-2026-106062 or the next vulnerability affects your stack