Source: gimp Version: 3.2.6-1 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream
Hi, The following vulnerability was published for gimp. CVE-2026-106062[0]: | A heap-based buffer overflow was found in GIMP’s DirectDraw Surface | (DDS) loader. When loading a crafted DDS image, buffer sizes derived | from width, height, and pitch can be computed using 32-bit | arithmetic that overflows. The allocated buffer is too small for the | amount of pixel data written through GEGL (CWE-787), following | integer overflow in size calculations (CWE-190). This may allow heap | corruption and, in the worst case, arbitrary code execution in the | context of the GIMP process. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-106062 https://www.cve.org/CVERecord?id=CVE-2026-106062 [1] https://bugzilla.redhat.com/show_bug.cgi?id=2546654 [2] https://gitlab.gnome.org/GNOME/gimp/-/work_items/16801 [3] https://gitlab.gnome.org/GNOME/gimp/-/merge_requests/3045 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
