CVE-2026-106064: Gimp: gimp: heap buffer overflow in gif export on oversized image dimensions
A heap-based buffer overflow was found in GIMP’s GIF export plug-in. Exporting an image with very large width and height can cause 32-bit overflow when computing the pixel buffer size. The plug-in allocates a buffer based on the wrapped value while GEGL writes using the true image extent, rooted in integer overflow
Other sources
Finding 4. plug-ins/common/file-gif-export.c, exportimage() (~1053–1057). Same allocation vs GEGL extent mismatch. ASan WRITE. Vector: GIF export on oversized image. CVSS tentative: 6.3 (AC:H).
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems are exposed when a user locally exports an image with very large dimensions through GIMP’s GIF export plug-in. The CVSS vector identifies the attack vector as local.
What conditions are required for exploitation?
Exploitation requires GIF export of an oversized image and user interaction. The CVSS vector indicates no privileges are required, but exploitation has high attack complexity.
What is the expected security impact?
The reported impact is high integrity and availability impact, with no confidentiality impact. The overflow occurs when a buffer sized from a wrapped 32-bit calculation is written according to the true image extent.