CVE-2026-106067: Gimp: gimp: heap buffer overflow in hot color filter on oversized image
Published Oct 7, 2026
·Updated
A heap-based buffer overflow was found in GIMP’s Hot color filter plug-in. For very large images, a pixel buffer is allocated using overflowing 32-bit width height (and related) arithmetic while the filter’s pixel access path uses the true image size, after integer overflow in the allocation size
Other sources
Finding 7. plug-ins/common/hot.c, pluginCore() (~429–443, 618). Same wrapped allocation vs internal/GEGL consumer extent. ASan WRITE. Vector: apply Hot filter on oversized image (filter path, not file parser). CVSS tentative: 6.3 (AC:H).
— Red Hat
Affected Software
1 affected component
GIMP GIMP
Event History
Oct 7, 2026
Data Sourced
via Red Hat·02:28 PM
DescriptionSeverityAffected Software
CVE Published
via MITRE·05:36 PM
Data Sourced
via MITRE·05:36 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·06:17 PM
DescriptionSeverityWeakness