CVE-2026-106062

A heap-based buffer overflow was found in GIMP’s DirectDraw Surface (DDS) loader. When loading a crafted DDS image, buffer sizes derived from width, height, and pitch can be computed using 32-bit arithmetic that overflows. The allocated buffer is too small for the amount of pixel data written through GEGL, following integer overflow in size calculations. This may allow heap corruption and, in the worst case, arbitrary code execution in the context of the GIMP process.

A heap-based buffer overflow was found in GIMP’s DirectDraw Surface (DDS) loader. When loading a crafted DDS image, buffer sizes derived from width, height, and pitch can be computed using 32-bit arithmetic that overflows. The allocated buffer is too small for the amount of pixel data written through GEGL, following integer overflow in size calculations. This may allow heap corruption and, in the worst case, arbitrary code execution in the context of the GIMP process.

A heap-based buffer overflow was found in GIMP’s DirectDraw Surface (DDS) loader. When loading a crafted DDS image, buffer sizes derived from width, height, and pitch can be computed using 32-bit arithmetic that overflows. The allocated buffer is too small for the amount of pixel data written through GEGL (CWE-787), following integer overflow in size calculations (CWE-190). This may allow heap corruption and, in the worst case, arbitrary code execution in the context of the GIMP process.

A heap-based buffer overflow was found in GIMP’s DirectDraw Surface (DDS) loader. When loading a crafted DDS image, buffer sizes derived from width, height, and pitch can be computed using 32-bit arithmetic that overflows. The allocated buffer is too small for the amount of pixel data written through GEGL, following integer overflow in size calculations. This may allow heap corruption and, in the worst case, arbitrary code execution in the context of the GIMP process.

A heap-based buffer overflow was found in GIMP’s DirectDraw Surface (DDS) loader. When loading a crafted DDS image, buffer sizes derived from width, height, and pitch can be computed using 32-bit arithmetic that overflows. The allocated buffer is too small for the amount of pixel data written through GEGL, following integer overflow in size calculations. This may allow heap corruption and, in the worst case, arbitrary code execution in the context of the GIMP process.

A heap-based buffer overflow was found in GIMP’s DirectDraw Surface (DDS) loader. When loading a crafted DDS image, buffer sizes derived from width, height, and pitch can be computed using 32-bit arithmetic that overflows. The allocated buffer is too small for the amount of pixel data written through GEGL, following integer overflow in size calculations. This may allow heap corruption and, in the worst case, arbitrary code execution in the context of the GIMP process.

The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.

Security Fix(es):

• gimp: GIMP: heap buffer overflow in DDS loader on crafted DirectDraw Surface file (CVE-2026-106062)
• gimp: gimp: heap out-of-bounds read/write in PSD thumbnail loader (load_resource_1033) (CVE-2026-112257)
• gimp: gimp: use-after-free in XCF loader via PROP_LINKED and PROP_SELECTION on channels (CVE-2026-112258)
• gimp: gimp: heap out-of-bounds read in XCF text-layer parasite parsing (CVE-2026-112260)
• gimp: gimp: use-after-free in XCF loader via PROP_SELECTED_PATH (CVE-2026-112261)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for gimp fixes the following issues:

Changes in gimp:

• CVE-2026-106061: plug-ins: Bound allocation for XMC import (bsc#1284473)
• CVE-2026-106062: plug-ins/file-dds: fix out of bounds write (bsc#1284474)
• CVE-2026-106063: plug-ins: Add bounds checks for DICOM export (bsc#1284475)
• CVE-2026-82324: plug-ins: Add more checks for IFF import (bsc#1277594)
• CVE-2026-82328: plug-ins: Use BPP for ICO palette allocation (bsc#1277618)
• CVE-2026-82343: plug-ins: fix heap out of bounds in PSD loader (bsc#1277622)

This update for gimp fixes the following issues:

• CVE-2026-82328: undersized palette memory allocations in the ICO loader can cause heap out-of-bounds reads (bsc#1277618).
• CVE-2026-82343: improper channel-count handling in the PSD loader can cause heap and stack out-of-bounds reads (bsc#1277622).
• CVE-2026-106061: integer overflow in the X cursor thumbnail loader leads to out-of-bounds read and process crash when generating a thumbnail for a crafted XMC file (bsc#1284473).
• CVE-2026-106062: heap-based buffer overflow in DirectDraw Surface loader when loading a crafted DDS image (bsc#1284474).
• CVE-2026-106063: heap-based buffer overflow in the DICOM export plug-in when exporting an image with extremely large width and height (bsc#1284475).