CVE-2026-106061

A flaw was found in GIMP’s X cursor (XMC) thumbnail loader. When GIMP generates a thumbnail for a crafted XMC file, it allocates a pixel buffer using a width * height size computed in 32-bit signed arithmetic. If that product overflows, the allocation is smaller than the true image extent. A subsequent GEGL buffer read uses the unwrapped dimensions and performs an out-of-bounds read on the heap, after integer overflow in the size calculation. This can crash GIMP or corrupt process memory.

A flaw was found in GIMP’s X cursor (XMC) thumbnail loader. When GIMP generates a thumbnail for a crafted XMC file, it allocates a pixel buffer using a width * height size computed in 32-bit signed arithmetic. If that product overflows, the allocation is smaller than the true image extent. A subsequent GEGL buffer read uses the unwrapped dimensions and performs an out-of-bounds read on the heap, after integer overflow in the size calculation. This can crash GIMP or corrupt process memory.

A flaw was found in GIMP’s X cursor (XMC) thumbnail loader. When GIMP generates a thumbnail for a crafted XMC file, it allocates a pixel buffer using a width * height size computed in 32-bit signed arithmetic. If that product overflows, the allocation is smaller than the true image extent. A subsequent GEGL buffer read uses the unwrapped dimensions and performs an out-of-bounds read on the heap (CWE-125), after integer overflow in the size calculation (CWE-190). This can crash GIMP or corrupt process memory.

A flaw was found in GIMP’s X cursor (XMC) thumbnail loader. When GIMP generates a thumbnail for a crafted XMC file, it allocates a pixel buffer using a width * height size computed in 32-bit signed arithmetic. If that product overflows, the allocation is smaller than the true image extent. A subsequent GEGL buffer read uses the unwrapped dimensions and performs an out-of-bounds read on the heap, after integer overflow in the size calculation. This can crash GIMP or corrupt process memory.

A flaw was found in GIMP’s X cursor (XMC) thumbnail loader. When GIMP generates a thumbnail for a crafted XMC file, it allocates a pixel buffer using a width * height size computed in 32-bit signed arithmetic. If that product overflows, the allocation is smaller than the true image extent. A subsequent GEGL buffer read uses the unwrapped dimensions and performs an out-of-bounds read on the heap, after integer overflow in the size calculation. This can crash GIMP or corrupt process memory.

A flaw was found in GIMP’s X cursor (XMC) thumbnail loader. When GIMP generates a thumbnail for a crafted XMC file, it allocates a pixel buffer using a width * height size computed in 32-bit signed arithmetic. If that product overflows, the allocation is smaller than the true image extent. A subsequent GEGL buffer read uses the unwrapped dimensions and performs an out-of-bounds read on the heap, after integer overflow in the size calculation. This can crash GIMP or corrupt process memory.

This update for gimp fixes the following issues:

Changes in gimp:

• CVE-2026-106061: plug-ins: Bound allocation for XMC import (bsc#1284473)
• CVE-2026-106062: plug-ins/file-dds: fix out of bounds write (bsc#1284474)
• CVE-2026-106063: plug-ins: Add bounds checks for DICOM export (bsc#1284475)
• CVE-2026-82324: plug-ins: Add more checks for IFF import (bsc#1277594)
• CVE-2026-82328: plug-ins: Use BPP for ICO palette allocation (bsc#1277618)
• CVE-2026-82343: plug-ins: fix heap out of bounds in PSD loader (bsc#1277622)

This update for gimp fixes the following issues:

• CVE-2026-82328: undersized palette memory allocations in the ICO loader can cause heap out-of-bounds reads (bsc#1277618).
• CVE-2026-82343: improper channel-count handling in the PSD loader can cause heap and stack out-of-bounds reads (bsc#1277622).
• CVE-2026-106061: integer overflow in the X cursor thumbnail loader leads to out-of-bounds read and process crash when generating a thumbnail for a crafted XMC file (bsc#1284473).
• CVE-2026-106062: heap-based buffer overflow in DirectDraw Surface loader when loading a crafted DDS image (bsc#1284474).
• CVE-2026-106063: heap-based buffer overflow in the DICOM export plug-in when exporting an image with extremely large width and height (bsc#1284475).