CVE-2026-106063

A heap-based buffer overflow was found in GIMP’s DICOM export plug-in. When exporting an image with extremely large width and height, the export path allocates a buffer using a 32-bit width * height (and bytes-per-pixel) product that can overflow. GEGL then writes the full uncompressed extent into the undersized buffer, after integer overflow in the allocation size

A heap-based buffer overflow was found in GIMP’s DICOM export plug-in. When exporting an image with extremely large width and height, the export path allocates a buffer using a 32-bit width * height (and bytes-per-pixel) product that can overflow. GEGL then writes the full uncompressed extent into the undersized buffer, after integer overflow in the allocation size

A heap-based buffer overflow was found in GIMP’s DICOM export plug-in. When exporting an image with extremely large width and height, the export path allocates a buffer using a 32-bit width * height (and bytes-per-pixel) product that can overflow. GEGL then writes the full uncompressed extent into the undersized buffer (CWE-787), after integer overflow in the allocation size

A heap-based buffer overflow was found in GIMP’s DICOM export plug-in. When exporting an image with extremely large width and height, the export path allocates a buffer using a 32-bit width * height (and bytes-per-pixel) product that can overflow. GEGL then writes the full uncompressed extent into the undersized buffer, after integer overflow in the allocation size

A heap-based buffer overflow was found in GIMP’s DICOM export plug-in. When exporting an image with extremely large width and height, the export path allocates a buffer using a 32-bit width * height (and bytes-per-pixel) product that can overflow. GEGL then writes the full uncompressed extent into the undersized buffer, after integer overflow in the allocation size

A heap-based buffer overflow was found in GIMP’s DICOM export plug-in. When exporting an image with extremely large width and height, the export path allocates a buffer using a 32-bit width * height (and bytes-per-pixel) product that can overflow. GEGL then writes the full uncompressed extent into the undersized buffer, after integer overflow in the allocation size

This update for gimp fixes the following issues:

Changes in gimp:

• CVE-2026-106061: plug-ins: Bound allocation for XMC import (bsc#1284473)
• CVE-2026-106062: plug-ins/file-dds: fix out of bounds write (bsc#1284474)
• CVE-2026-106063: plug-ins: Add bounds checks for DICOM export (bsc#1284475)
• CVE-2026-82324: plug-ins: Add more checks for IFF import (bsc#1277594)
• CVE-2026-82328: plug-ins: Use BPP for ICO palette allocation (bsc#1277618)
• CVE-2026-82343: plug-ins: fix heap out of bounds in PSD loader (bsc#1277622)

This update for gimp fixes the following issues:

• CVE-2026-82328: undersized palette memory allocations in the ICO loader can cause heap out-of-bounds reads (bsc#1277618).
• CVE-2026-82343: improper channel-count handling in the PSD loader can cause heap and stack out-of-bounds reads (bsc#1277622).
• CVE-2026-106061: integer overflow in the X cursor thumbnail loader leads to out-of-bounds read and process crash when generating a thumbnail for a crafted XMC file (bsc#1284473).
• CVE-2026-106062: heap-based buffer overflow in DirectDraw Surface loader when loading a crafted DDS image (bsc#1284474).
• CVE-2026-106063: heap-based buffer overflow in the DICOM export plug-in when exporting an image with extremely large width and height (bsc#1284475).