Skip to content
OpenAdvisories
Medium · 6.1 CVE-2026-62438 EUVD-2026-103188GHSA-g4v7-36q4-hpjm

Gimp: gimp: paa integer overflow out-of-bounds read

Published Oct 16, 2026 · Updated Nov 6, 2026 · Assigned by redhat

Description

A flaw was found in GIMP. An attacker can cause a Denial of Service (DoS) or potentially disclose sensitive memory contents by convincing a user to open or preview a specially crafted Bohemia Interactive (PAA) texture file. Due to an integer overflow when calculating image dimensions during file decompression, the application allocates an undersized memory buffer. Subsequent processing reads memory past the buffer boundary, terminating the plug-in process unexpectedly.

Affected products

VendorProductAffectedFixed
Red Hat Red Hat Enterprise Linux 10 — —
Red Hat Red Hat Enterprise Linux 6 — —
Red Hat Red Hat Enterprise Linux 7 — —
Red Hat Red Hat Enterprise Linux 8 — —
Red Hat Red Hat Enterprise Linux 9 — —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 gimp 3.2.6-1 —
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS gimp No fix yet —
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS gimp No fix yet —
Ubuntu Pro 22.04 LTS gimp No fix yet —
Ubuntu Pro 20.04 LTS gimp No fix yet —
Ubuntu Pro 18.04 LTS gimp No fix yet —
Ubuntu Pro 16.04 LTS gimp No fix yet —

Advisories 1

References