CVEvulnerability

CVE-2026-78465

7.0 HIGH Published 2026-08-24 Modified 2026-10-14 Official page ↗
Status
Analyzed
Published
2026-08-24
Last modified
2026-10-14
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.0 HIGH — CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-190

Description

A flaw was found in the file-pcx plugin in GIMP, affecting 32-bit builds only. When processing a PCX image file, the plugin calculates memory allocation sizes based on the image dimensions and the number of color planes. If a crafted file sets the number of planes to 4 alongside sufficiently large dimensions, the calculation exceeds the 32-bit integer limit and overflows, resulting in an undersized heap-based buffer allocation. This integer overflow issue results in a heap-based buffer overflow when the plugin subsequently writes image data into the undersized buffer, causing memory corruption, potentially leading to arbitrary code execution or a denial of service.

Affected configurations

• gimp gimp (>= 3.0.0 <= 3.2.4) • gimp gimp 3.3.1

Related

Weakness · CWE (1)

  • CWE-190 Integer Overflow or Wraparound weakness

References