CVE-2026-106063: Gimp: gimp: heap buffer overflow in dicom export on oversized image dimensions
A heap-based buffer overflow was found in GIMP’s DICOM export plug-in. When exporting an image with extremely large width and height, the export path allocates a buffer using a 32-bit width height (and bytes-per-pixel) product that can overflow. GEGL then writes the full uncompressed extent into the undersized buffer, after integer overflow in the allocation size
Other sources
Finding 3. plug-ins/common/file-dicom.c, exportimage() (~1649–1652). Wrapped width height bpp allocation; GEGL write exceeds buffer. SIGSEGV/ASan WRITE. Vector: export to DICOM on very large image (multi‑GB scale), not a small malicious download alone. CVSS tentative: AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H (6.3).
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/gimpto a version that resolves this vulnerability.Fixed in 3.2.8-1
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Users who export extremely large, multi-gigabyte-scale images to DICOM are exposed. The issue is local and requires user interaction with the export operation; a small malicious download alone is not sufficient.
What conditions are required to trigger the overflow?
An attacker or user must cause GIMP to export an image with width and height large enough for the 32-bit width × height × bytes-per-pixel allocation calculation to overflow. GEGL must then write the image's full uncompressed extent into the resulting undersized buffer.
How can I reduce risk if I cannot patch immediately?
Avoid exporting extremely large images to DICOM, particularly multi-gigabyte-scale uncompressed image data. Keep image dimensions and resulting pixel-buffer sizes below values that could overflow a 32-bit allocation-size calculation.
How would exploitation or a failed trigger appear?
The described behavior can produce a heap buffer overflow during DICOM export, including a segmentation fault or an AddressSanitizer out-of-bounds write report. The affected code path is the DICOM export plug-in's export_image() function in plug-ins/common/file-dicom.c.