CVE-2026-106062: Gimp: gimp: heap buffer overflow in dds loader on crafted directdraw surface file
A heap-based buffer overflow was found in GIMP’s DirectDraw Surface (DDS) loader. When loading a crafted DDS image, buffer sizes derived from width, height, and pitch can be computed using 32-bit arithmetic that overflows. The allocated buffer is too small for the amount of pixel data written through GEGL (CWE-787), following integer overflow in size calculations (CWE-190). This may allow heap corruption and, in the worst case, arbitrary code execution in the context of the GIMP process.
Other sources
A heap-based buffer overflow was found in GIMP’s DirectDraw Surface (DDS) loader. When loading a crafted DDS image, buffer sizes derived from width, height, and pitch can be computed using 32-bit arithmetic that overflows. The allocated buffer is too small for the amount of pixel data written through GEGL, following integer overflow in size calculations. This may allow heap corruption and, in the worst case, arbitrary code execution in the context of the GIMP process.
— NVD
Same upstream issue, Finding 2. plug-ins/common/ddsread.c, readdds() / loadlayer() (~428–1313): pitch/buffer sizing with wrapped width height (and related fields); GEGL writes past heap buffer. ASan-confirmed heap-buffer-overflow write. Vector: load crafted DDS file. Survives prior DDS fix CVE-2026-42170 (commit 7dff816) per reporter. CVSS tentative: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (7.8).
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users who load DDS image files in GIMP are exposed. Exploitation occurs in the context of the GIMP process, so the impact is limited to the privileges of the user running GIMP.
What does an attacker need to exploit it?
An attacker needs to convince a user to load a crafted DirectDraw Surface (DDS) image in GIMP. No attacker privileges are required, but user interaction is required.
Does the previous DDS fix address this flaw?
No. The report states that this issue survives the prior DDS fix tracked as CVE-2026-42170 and commit 7dff816.
What is the likely impact after a malicious DDS file is opened?
The crafted image can trigger an integer overflow in width, height, and pitch-based buffer sizing, followed by a heap buffer overflow during GEGL pixel writes. This can cause heap corruption and may enable arbitrary code execution in the GIMP process.