CVE-2026-106063: Gimp: gimp: heap buffer overflow in dicom export on oversized image dimensions

Published Oct 6, 2026

Updated

A heap-based buffer overflow was found in GIMP’s DICOM export plug-in. When exporting an image with extremely large width and height, the export path allocates a buffer using a 32-bit width height (and bytes-per-pixel) product that can overflow. GEGL then writes the full uncompressed extent into the undersized buffer (CWE-787), after integer overflow in the allocation size

Other sources

Finding 3. plug-ins/common/file-dicom.c, exportimage() (~1649–1652). Wrapped width height bpp allocation; GEGL write exceeds buffer. SIGSEGV/ASan WRITE. Vector: export to DICOM on very large image (multi‑GB scale), not a small malicious download alone. CVSS tentative: AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H (6.3).

— Red Hat

Affected Software

1 affected component

GIMP GIMP

Event History

Oct 6, 2026

Data Sourced

via Red Hat·04:35 PM

DescriptionSeverityAffected Software

CVE Published

via MITRE·07:34 PM

Data Sourced

via MITRE·07:34 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is realistically exposed to this issue?

Users who export extremely large, multi-gigabyte-scale images to DICOM are exposed. The issue is local and requires user interaction with the export operation; a small malicious download alone is not sufficient.

What conditions are required to trigger the overflow?

An attacker or user must cause GIMP to export an image with width and height large enough for the 32-bit width × height × bytes-per-pixel allocation calculation to overflow. GEGL must then write the image's full uncompressed extent into the resulting undersized buffer.

How can I reduce risk if I cannot patch immediately?

Avoid exporting extremely large images to DICOM, particularly multi-gigabyte-scale uncompressed image data. Keep image dimensions and resulting pixel-buffer sizes below values that could overflow a 32-bit allocation-size calculation.

How would exploitation or a failed trigger appear?

The described behavior can produce a heap buffer overflow during DICOM export, including a segmentation fault or an AddressSanitizer out-of-bounds write report. The affected code path is the DICOM export plug-in's export_image() function in plug-ins/common/file-dicom.c.

CVE-2026-106063: Gimp: gimp: heap buffer overflow in dicom export on oversized image dimensions

Other sources

Affected Software

Event History

Frequently Asked Questions

Who is realistically exposed to this issue?

What conditions are required to trigger the overflow?

How can I reduce risk if I cannot patch immediately?

How would exploitation or a failed trigger appear?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

What conditions are required to trigger the overflow?

How can I reduce risk if I cannot patch immediately?

How would exploitation or a failed trigger appear?