CVE-2026-106065: Gimp: gimp: heap buffer overflow in pcx export on oversized image dimensions
A heap-based buffer overflow was found in GIMP’s PCX export plug-in. For images with extremely large width and height, buffer allocation uses overflowing 32-bit width height arithmetic while subsequent GEGL operations use the full extent, after integer overflow in size calculation
Other sources
Finding 5. plug-ins/common/file-pcx.c, exportimage() (~1192–1195). SIGSEGV/heap WRITE on export. CVSS tentative: 6.3 (AC:H).
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the overflow?
The issue is triggered when exporting a PCX image with extremely large width and height values. Exploitation also requires user interaction and has high attack complexity according to the tentative CVSS vector.
Is this remotely exploitable without local interaction?
The available CVSS vector lists local attack vector and required user interaction. The provided data does not indicate a network-reachable attack path.
What is the likely impact if the vulnerable export path is reached?
The reported behavior includes a heap write and SIGSEGV during export. The tentative CVSS assessment identifies integrity and availability impact as high, while confidentiality impact is listed as none.