CVE-2026-106067: Gimp: gimp: heap buffer overflow in hot color filter on oversized image
A heap-based buffer overflow was found in GIMP’s Hot color filter plug-in. For very large images, a pixel buffer is allocated using overflowing 32-bit width height (and related) arithmetic while the filter’s pixel access path uses the true image size, after integer overflow in the allocation size
Other sources
Finding 7. plug-ins/common/hot.c, pluginCore() (~429–443, 618). Same wrapped allocation vs internal/GEGL consumer extent. ASan WRITE. Vector: apply Hot filter on oversized image (filter path, not file parser). CVSS tentative: 6.3 (AC:H).
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/gimpto a version that resolves this vulnerability.Fixed in 3.2.8-1
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Users who process very large images with GIMP and apply the Hot color filter are exposed. The issue is in the filter execution path rather than the image-file parsing path.
What is required to trigger the overflow?
The Hot filter must be applied to an oversized image. Exploitation also requires local access, high attack complexity, and user interaction according to the provided CVSS vector.
Does simply opening a malicious image trigger the issue?
No. The described trigger is applying the Hot filter to an oversized image, not opening or parsing an image file.
What is the impact if exploitation succeeds?
The overflow is described as an ASan-detected write and is rated with high integrity and availability impact. The provided CVSS vector indicates no confidentiality impact.