CVE-2026-106066: Gimp: gimp: heap buffer overflow in raw data export on oversized image dimensions
A heap-based buffer overflow was found in GIMP’s raw data export plug-in. When exporting very large images, gmalloc() sizing based on overflowing width height bytes-per-pixel can allocate far less memory than GEGL reads or writes during export, following integer overflow
Other sources
Finding 6. plug-ins/common/file-raw-data.c, exportimage() (~1510–1512). PoC example W=32770, H=32768 (RGBA). ASan WRITE via geglbufferiteratereadsimple. CVSS tentative: 6.3 (AC:H).
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/gimpto a version that resolves this vulnerability.Fixed in 3.2.8-1
Event History
Frequently Asked Questions
Does exploitation require prior authentication or remote network access?
The vector is local and requires user interaction. The CVSS vector indicates no privileges are required, but an attacker would need to cause a user to process an oversized image through the raw data export workflow.
What is the expected security impact if exploitation succeeds?
The tentative CVSS assessment rates integrity and availability impact as high, with no confidentiality impact. The reported condition is a heap-based buffer overflow caused by integer overflow in allocation sizing.