CVE-2026-106061: Gimp: gimp: heap buffer over-read in x cursor (xmc) thumbnail loader on crafted file
A flaw was found in GIMP’s X cursor (XMC) thumbnail loader. When GIMP generates a thumbnail for a crafted XMC file, it allocates a pixel buffer using a width height size computed in 32-bit signed arithmetic. If that product overflows, the allocation is smaller than the true image extent. A subsequent GEGL buffer read uses the unwrapped dimensions and performs an out-of-bounds read on the heap (CWE-125), after integer overflow in the size calculation (CWE-190). This can crash GIMP or corrupt process memory.
Other sources
A flaw was found in GIMP’s X cursor (XMC) thumbnail loader. When GIMP generates a thumbnail for a crafted XMC file, it allocates a pixel buffer using a width height size computed in 32-bit signed arithmetic. If that product overflows, the allocation is smaller than the true image extent. A subsequent GEGL buffer read uses the unwrapped dimensions and performs an out-of-bounds read on the heap, after integer overflow in the size calculation. This can crash GIMP or corrupt process memory.
— NVD
Reporter: Jim Alves-Foss 1. Upstream: https://gitlab.gnome.org/GNOME/gimp/-/workitems/16801 (Finding 1). plug-ins/common/file-xmc.c, loadthumbnail() (~1032–1046): pixel buffer sized with 32-bit width height can wrap; GEGL then reads past the allocation. ASan-confirmed heap-buffer-overflow read. Vector: open/preview crafted X cursor (XMC) file (thumbnail path). Verified on GIMP 3.2.6; unpatched at report. CVSS 3.1 tentative: AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (5.5).
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of GIMP who open or preview X cursor (XMC) files are exposed. The issue was verified on GIMP 3.2.6, and the vulnerable code is reached through thumbnail generation.
What does an attacker need to exploit it?
An attacker needs to persuade a user to open or preview a crafted XMC file in GIMP. The CVSS vector indicates local attack access, no privileges required, and user interaction required.
What is the practical impact?
A crafted file can trigger an out-of-bounds heap read during thumbnail loading, which can crash GIMP or corrupt memory in the GIMP process. The reported CVSS impact is limited to availability.
What can be done if a fix is not yet available?
Avoid opening or previewing untrusted XMC files in GIMP, particularly where thumbnail generation may occur. The report states the issue was unpatched at the time of reporting.