{"id":"CVE-2026-106062","aliases":["ALSA-2026:93975","DEBIAN-CVE-2026-106062","EUVD-2026-93983","GHSA-cqfx-pmhf-jmh6","SUSE-SU-2026:4895-1","UBUNTU-CVE-2026-106062","openSUSE-SU-2026:22123-1"],"status":"published","title":"Gimp: gimp: heap buffer overflow in dds loader on crafted directdraw surface file","description":"A heap-based buffer overflow was found in GIMP’s DirectDraw Surface (DDS) loader. When loading a crafted DDS image, buffer sizes derived from width, height, and pitch can be computed using 32-bit arithmetic that overflows. The allocated buffer is too small for the amount of pixel data written through GEGL, following integer overflow in size calculations. This may allow heap corruption and, in the worst case, arbitrary code execution in the context of the GIMP process.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00157,"percentile":0.04905,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2026-10-06T20:02:52Z","modified":"2026-11-11T12:07:06Z","fixes":[{"ecosystem":"Debian:14","package":"gimp","fixed_in":["3.2.8-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.0.4-4.el9_8.15"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"gimp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.0.4-4.el9_8.15"}]}],"bundled":5},{"source":"osv","ecosystem":"Debian:12","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.10.34-1","2.10.34-1+deb12u1","2.10.34-1+deb12u10","2.10.34-1+deb12u2","2.10.34-1+deb12u3","2.10.34-1+deb12u4","2.10.34-1+deb12u5","2.10.34-1+deb12u6","2.10.34-1+deb12u7","2.10.34-1+deb12u8","2.10.34-1+deb12u9","2.10.36-1","2.10.36-2","2.10.36-3","2.10.38-1","2.10.38-2","2.99.10-1","2.99.12-1","2.99.12-2","2.99.14-1","2.99.14-2","2.99.16-1","2.99.16-2","2.99.18-1","3.0.0-1","3.0.0-2","3.0.0~RC1-1","3.0.0~RC1-3","3.0.0~RC1-4","3.0.0~RC2-1","3.0.0~RC3-1","3.0.2-1","3.0.2-2","3.0.2-3","3.0.2-3.1","3.0.4-1","3.0.4-2","3.0.4-3","3.0.4-4","3.0.4-5","3.0.4-6","3.0.4-6.1","3.0.4-6.2","3.0.6-1","3.2.0-1","3.2.0~RC2-1","3.2.0~RC2-2","3.2.0~RC2-3","3.2.0~RC2-3.1","3.2.0~RC2-3.2","3.2.0~RC2-3.3","3.2.0~RC3-1","3.2.2-1","3.2.4-1","3.2.4-2","3.2.4-3","3.2.6-1","3.2.8-1"]},{"source":"osv","ecosystem":"Debian:13","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.4-3","3.0.4-3+deb13u1","3.0.4-3+deb13u10","3.0.4-3+deb13u11","3.0.4-3+deb13u2","3.0.4-3+deb13u3","3.0.4-3+deb13u4","3.0.4-3+deb13u5","3.0.4-3+deb13u6","3.0.4-3+deb13u7","3.0.4-3+deb13u8","3.0.4-3+deb13u9","3.0.4-4","3.0.4-5","3.0.4-6","3.0.4-6.1","3.0.4-6.2","3.0.6-1","3.2.0-1","3.2.0~RC2-1","3.2.0~RC2-2","3.2.0~RC2-3","3.2.0~RC2-3.1","3.2.0~RC2-3.2","3.2.0~RC2-3.3","3.2.0~RC3-1","3.2.2-1","3.2.4-1","3.2.4-2","3.2.4-3","3.2.6-1","3.2.8-1"]},{"source":"osv","ecosystem":"Debian:14","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.8-1"}]}],"versions":["3.0.4-3","3.0.4-4","3.0.4-5","3.0.4-6","3.0.4-6.1","3.0.4-6.2","3.0.6-1","3.2.0-1","3.2.0~RC2-1","3.2.0~RC2-2","3.2.0~RC2-3","3.2.0~RC2-3.1","3.2.0~RC2-3.2","3.2.0~RC2-3.3","3.2.0~RC3-1","3.2.2-1","3.2.4-1","3.2.4-2","3.2.4-3","3.2.6-1"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.30-150400.3.85.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.30-150400.3.85.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.14-1ubuntu2","2.8.14-1.2ubuntu1","2.8.16-1ubuntu1","2.8.16-1ubuntu1.1","2.8.16-1ubuntu1.1+esm1","2.8.16-1ubuntu1.1+esm2","2.8.16-1ubuntu1.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.20-1","2.8.20-1.1","2.8.20-2","2.8.22-1","2.8.22-1ubuntu0.1~esm1","2.8.22-1ubuntu0.1~esm2","2.8.22-1ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.10.8-2","2.10.14-2","2.10.14-2build1","2.10.14-2ubuntu1","2.10.14-3","2.10.18-1","2.10.18-1ubuntu0.1","2.10.18-1ubuntu0.1+esm1","2.10.18-1ubuntu0.1+esm2","2.10.18-1ubuntu0.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.10.24-2","2.10.28-1","2.10.30-1","2.10.30-1build1","2.10.30-1ubuntu0.1","2.10.30-1ubuntu0.1+esm1","2.10.30-1ubuntu0.1+esm2","2.10.30-1ubuntu0.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.10.34-1","2.10.36-1","2.10.36-2","2.10.36-3build2","2.10.36-3build3","2.10.36-3ubuntu0.24.04.1","2.10.36-3ubuntu0.24.04.1+esm1","2.10.36-3ubuntu0.24.04.1+esm2","2.10.36-3ubuntu0.24.04.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.2-1","3.2.4-1","3.2.4-2","3.2.4-3","3.2.6-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.4-6.1","3.0.4-6.2","3.0.6-1","3.2.0~RC2-2","3.2.0~RC2-3","3.2.0~RC2-3.1","3.2.0~RC2-3.2","3.2.0~RC2-3.3","3.2.0~RC3-1","3.2.0-1","3.2.2-1","3.2.2-1ubuntu0.26.04.1"]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-bp160.13.1"}]}],"bundled":6}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:93975","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:98495","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-106062","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2546654","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106062"},{"url":"https://github.com/advisories/GHSA-cqfx-pmhf-jmh6"},{"url":"https://access.redhat.com/security/cve/CVE-2026-112257","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-112258","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-112260","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-112261","tags":["report"]},{"url":"https://bugzilla.redhat.com/2546654","tags":["report"]},{"url":"https://bugzilla.redhat.com/2555574","tags":["report"]},{"url":"https://bugzilla.redhat.com/2555588","tags":["report"]},{"url":"https://bugzilla.redhat.com/2555730","tags":["report"]},{"url":"https://bugzilla.redhat.com/2555748","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-93975.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-106062","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264895-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1277618","tags":["report"]},{"url":"https://bugzilla.suse.com/1277622","tags":["report"]},{"url":"https://bugzilla.suse.com/1284473","tags":["report"]},{"url":"https://bugzilla.suse.com/1284474","tags":["report"]},{"url":"https://bugzilla.suse.com/1284475","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-106061","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-106062","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-106063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-82328","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-82343","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-106062","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-106062","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1277594","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-82324","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-106062","title":"Gimp: gimp: heap buffer overflow in dds loader on crafted directdraw surface file","description":"A heap-based buffer overflow was found in GIMP’s DirectDraw Surface (DDS) loader. When loading a crafted DDS image, buffer sizes derived from width, height, and pitch can be computed using 32-bit arithmetic that overflows. The allocated buffer is too small for the amount of pixel data written through GEGL, following integer overflow in size calculations. This may allow heap corruption and, in the worst case, arbitrary code execution in the context of the GIMP process.","status":"published","published":"2026-10-06T20:02:52.466Z","modified":"2026-11-11T12:07:06.655Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-119"],"updated_at":"2026-11-11T13:28:04.456673Z"}],"euvd":[{"id":"EUVD-2026-93983","description":"A heap-based buffer overflow was found in GIMP’s DirectDraw Surface (DDS) loader. When loading a crafted DDS image, buffer sizes derived from width, height, and pitch can be computed using 32-bit arithmetic that overflows. The allocated buffer is too small for the amount of pixel data written through GEGL, following integer overflow in size calculations. This may allow heap corruption and, in the worst case, arbitrary code execution in the context of the GIMP process.","status":"published","published":"2026-10-06T20:02:52Z","modified":"2026-11-11T12:07:06Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-11T13:28:41.983834Z"}],"ghsa":[{"id":"GHSA-cqfx-pmhf-jmh6","title":"A heap-based buffer overflow was found in GIMP’s DirectDraw Surface (DDS) loader. When loading a...","description":"A heap-based buffer overflow was found in GIMP’s DirectDraw Surface (DDS) loader. When loading a crafted DDS image, buffer sizes derived from width, height, and pitch can be computed using 32-bit arithmetic that overflows. The allocated buffer is too small for the amount of pixel data written through GEGL (CWE-787), following integer overflow in size calculations (CWE-190). This may allow heap corruption and, in the worst case, arbitrary code execution in the context of the GIMP process.","status":"published","published":"2026-10-06T21:32:03Z","modified":"2026-11-11T15:31:48Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-119"],"updated_at":"2026-11-11T15:34:48.112751Z"}],"nvd":[{"id":"CVE-2026-106062","description":"A heap-based buffer overflow was found in GIMP’s DirectDraw Surface (DDS) loader. When loading a crafted DDS image, buffer sizes derived from width, height, and pitch can be computed using 32-bit arithmetic that overflows. The allocated buffer is too small for the amount of pixel data written through GEGL, following integer overflow in size calculations. This may allow heap corruption and, in the worst case, arbitrary code execution in the context of the GIMP process.","status":"published","published":"2026-10-06T21:17:04.903Z","modified":"2026-11-11T13:17:13.27Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-119"],"updated_at":"2026-11-11T15:25:15.031694Z"}],"osv":[{"id":"DEBIAN-CVE-2026-106062","description":"A heap-based buffer overflow was found in GIMP’s DirectDraw Surface (DDS) loader. When loading a crafted DDS image, buffer sizes derived from width, height, and pitch can be computed using 32-bit arithmetic that overflows. The allocated buffer is too small for the amount of pixel data written through GEGL, following integer overflow in size calculations. This may allow heap corruption and, in the worst case, arbitrary code execution in the context of the GIMP process.","status":"published","published":"2026-10-06T21:17:04.903Z","modified":"2026-11-12T09:47:34.02531959Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-08T22:11:41.975705Z"},{"id":"UBUNTU-CVE-2026-106062","description":"A heap-based buffer overflow was found in GIMP’s DirectDraw Surface (DDS) loader. When loading a crafted DDS image, buffer sizes derived from width, height, and pitch can be computed using 32-bit arithmetic that overflows. The allocated buffer is too small for the amount of pixel data written through GEGL, following integer overflow in size calculations. This may allow heap corruption and, in the worst case, arbitrary code execution in the context of the GIMP process.","status":"published","published":"2026-10-06T21:17:00Z","modified":"2026-10-17T12:58:00.110093981Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:59.130573Z"},{"id":"ALSA-2026:93975","title":"Important: gimp security update","description":"The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.  \n\nSecurity Fix(es):  \n\n  * gimp: GIMP: heap buffer overflow in DDS loader on crafted DirectDraw Surface file (CVE-2026-106062)\n  * gimp: gimp: heap out-of-bounds read/write in PSD thumbnail loader (load_resource_1033) (CVE-2026-112257)\n  * gimp: gimp: use-after-free in XCF loader via PROP_LINKED and PROP_SELECTION on channels (CVE-2026-112258)\n  * gimp: gimp: heap out-of-bounds read in XCF text-layer parasite parsing (CVE-2026-112260)\n  * gimp: gimp: use-after-free in XCF loader via PROP_SELECTED_PATH (CVE-2026-112261)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-11-02T00:00:00Z","modified":"2026-11-04T16:45:03.664201969Z","updated_at":"2026-11-04T17:11:08.071099Z"},{"id":"openSUSE-SU-2026:22123-1","title":"Security update for gimp","description":"This update for gimp fixes the following issues:\n\nChanges in gimp:\n\n- CVE-2026-106061: plug-ins: Bound allocation for XMC import (bsc#1284473)\n- CVE-2026-106062: plug-ins/file-dds: fix out of bounds write (bsc#1284474)\n- CVE-2026-106063: plug-ins: Add bounds checks for DICOM export (bsc#1284475)\n- CVE-2026-82324: plug-ins: Add more checks for IFF import (bsc#1277594)\n- CVE-2026-82328: plug-ins: Use BPP for ICO palette allocation (bsc#1277618)\n- CVE-2026-82343: plug-ins: fix heap out of bounds in PSD loader (bsc#1277622)\n","status":"published","published":"2026-10-16T20:56:27Z","modified":"2026-10-19T17:23:15.387370168Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:4895-1","title":"Security update for gimp","description":"This update for gimp fixes the following issues:\n\n- CVE-2026-82328: undersized palette memory allocations in the ICO loader can cause heap out-of-bounds reads\n  (bsc#1277618).\n- CVE-2026-82343: improper channel-count handling in the PSD loader can cause heap and stack out-of-bounds reads\n  (bsc#1277622).\n- CVE-2026-106061: integer overflow in the X cursor thumbnail loader leads to out-of-bounds read and process crash when\n  generating a thumbnail for a crafted XMC file (bsc#1284473).\n- CVE-2026-106062: heap-based buffer overflow in DirectDraw Surface loader when loading a crafted DDS image\n  (bsc#1284474).\n- CVE-2026-106063: heap-based buffer overflow in the DICOM export plug-in when exporting an image with extremely large\n  width and height (bsc#1284475).\n","status":"published","published":"2026-10-23T10:51:03Z","modified":"2026-10-24T17:23:09.3459046Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}