Denial of Service Vulnerability in GIMP Affects Users Through Malicious Texture Files
CVE-2026-62438

6.1MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Vendor
CVE Published:
16 October 2026

What is CVE-2026-62438?

A vulnerability in GIMP allows for Denial of Service (DoS) or potential disclosure of sensitive memory contents when a user opens or previews a specially crafted Bohemia Interactive (PAA) texture file. The flaw stems from an integer overflow during the calculation of image dimensions in the file's decompression process. This causes the application to allocate insufficient memory buffers, leading to memory being read beyond its boundaries, which in turn can crash the plug-in unexpectedly.

References

https://access.redhat.com/security/cve/CVE-2026-62438
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2554456
issue-trackingx_refsource_REDHAT
https://gitlab.gnome.org/GNOME/gimp/-/issues/16313

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Florent Saudel for reporting this issue.
.