CVE-2026-106062

Name	CVE-2026-106062
Description	A heap-based buffer overflow was found in GIMP’s DirectDraw Surface (DDS) loader. When loading a crafted DDS image, buffer sizes derived from width, height, and pitch can be computed using 32-bit arithmetic that overflows. The allocated buffer is too small for the amount of pixel data written through GEGL, following integer overflow in size calculations. This may allow heap corruption and, in the worst case, arbitrary code execution in the context of the GIMP process.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1150242

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
gimp (PTS)	bookworm, bookworm (security)	2.10.34-1+deb12u10	vulnerable
	trixie	3.0.4-3+deb13u10	vulnerable
	trixie (security)	3.0.4-3+deb13u11	vulnerable
	forky, sid	3.2.6-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
gimp	source	(unstable)	(unfixed)			1150242

Notes

https://bugzilla.redhat.com/show_bug.cgi?id=2546654
https://gitlab.gnome.org/GNOME/gimp/-/work_items/16801
https://gitlab.gnome.org/GNOME/gimp/-/merge_requests/3045
Fixed by: https://gitlab.gnome.org/GNOME/gimp/-/commit/d528365f7644099d8e07f999660ed0aa71210d85
Fixed by: https://gitlab.gnome.org/GNOME/gimp/-/commit/01e6663942adebb347d11ffc7d94ac23da01ff62