CVE-2026-106065 in Red Hat
Summary
by MITRE • 10/07/2026
A heap-based buffer overflow was found in GIMP’s PCX export plug-in. For images with extremely large width and height, buffer allocation uses overflowing 32-bit width * height arithmetic while subsequent GEGL operations use the full extent, after integer overflow in size calculation
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified as a heap-based buffer overflow within GIMP’s PCX export plug-in stems from an improper handling of image dimensions during memory allocation. Specifically, when processing images with extremely large width and height values, the software performs arithmetic multiplication to determine the required buffer size for storing pixel data. This calculation relies on 32-bit integer arithmetic, which lacks sufficient capacity to represent the product of two very large integers without wrapping around or overflowing. Consequently, if the true mathematical result exceeds the maximum value representable by a signed or unsigned 32-bit integer, the resulting allocated memory block is significantly smaller than what is actually required for the image data. This discrepancy creates a critical mismatch between the declared buffer size and the actual data volume that subsequent operations intend to write into it.
Following the flawed allocation step, the GNU Image Manipulation Program utilizes GEGL, its graph-based image processing framework, to handle various transformations and exports. These downstream operations assume that the allocated memory is adequate for the full extent of the image dimensions provided by the user or source file. Because the initial size calculation suffered from integer overflow, the subsequent write operations proceed without bounds checking relative to the actual buffer limits. As GEGL attempts to populate the PCX export structure with pixel data corresponding to the original large width and height, it writes beyond the boundaries of the under-allocated heap memory segment. This out-of-bounds write constitutes a classic heap-based buffer overflow condition, allowing arbitrary data to be written into adjacent memory regions on the heap.
The operational impact of this vulnerability is severe, potentially leading to application crashes or remote code execution depending on the context in which GIMP processes untrusted image files. An attacker could craft a malicious PCX file with specific width and height parameters that trigger the integer overflow during export preparation. When the victim opens such a file and initiates an export operation, the resulting heap corruption can corrupt adjacent memory structures, including function pointers or object metadata stored on the heap. In scenarios where GIMP is used to process files from untrusted sources, this flaw presents a significant risk of exploitation for arbitrary code execution with the privileges of the user running the application. The vulnerability highlights the dangers of relying on fixed-width integer types for size calculations involving potentially large inputs without explicit overflow checks or the use of larger data types such as 64-bit integers.
From a classification perspective, this flaw aligns closely with CWE-190, which describes Integer Overflow or Wraparound, and CWE-787, which covers Out-of-bounds Write on Heap. The exploitation technique leverages memory corruption to gain control over program execution flow, mapping to MITRE ATT&CK techniques related to Memory Corruption and potentially Command and Scripting Interpreter if the overflow allows for shellcode injection or ROP chain construction. Mitigation strategies must focus on enforcing strict input validation before performing arithmetic operations that determine buffer sizes. Developers should implement checks to ensure that width multiplied by height does not exceed a safe threshold, preferably using 64-bit integers for intermediate calculations and verifying against maximum allowable image dimensions defined by the PCX specification or application constraints. Additionally, incorporating bounds checking in GEGL operations would provide defense-in-depth, ensuring that even if allocation errors occur, subsequent memory writes are validated against actual buffer limits rather than assumed sizes.