CVE-2026-62438: Gimp: gimp: paa integer overflow out-of-bounds read
A flaw was found in GIMP. An attacker can cause a Denial of Service (DoS) or potentially disclose sensitive memory contents by convincing a user to open or preview a specially crafted Bohemia Interactive (PAA) texture file. Due to an integer overflow when calculating image dimensions during file decompression, the application allocates an undersized memory buffer. Subsequent processing reads memory past the buffer boundary, terminating the plug-in process unexpectedly.
Other sources
GIMP ships a plug-in (file-paa) that loads textures stored in the Bohemia Interactive PAA texture format. The loader computes the size of an intermediate decompression buffer with a 32-bit multiplication on the width × height × bytes-per-pixel value extracted from the file header. For specific 16-bit dimension pairs (e.g. width=32 768, height=32 769) the product overflows a 32-bit unsigned integer and wraps to a small value (131 072 bytes in the demonstrated case). GIMP allocates the wrapped (small) size, fills it with decompressed data, and then commits the buffer to a GEGL pixel buffer using the original (large) width × height rectangle. GEGL therefore reads gigabytes past the end of the heap allocation through memcpy, dereferencing unmapped memory and crashing the plug-in process. Triggering the vulnerability requires only that the user (or an automated preview/thumbnail consumer) open or peek at a crafted .paa file — for example by double-clicking the file, dragging it into GIMP, or by an indexer/file manager that runs GIMP's thumbnailer. The immediate observable effect is a reliable crash of the GIMP plug-in process (denial of service of the load operation, image data lost). Because the out-of-bounds read precedes the crash and copies adjacent heap memory into pixel data committed to a GEGL buffer, the bug also has the potential to disclose contents of the plug-in's heap through any pixel data that is rendered, exported, or copied to the clipboard before the read walks off the end of mapped memory. CWE-190 (Integer Overflow or Wraparound) leading to CWE-125 (Out-of-bounds Read).
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Does exploitation require the victim to open the file, or can it occur merely by receiving it?
The victim must open or preview a specially crafted PAA texture file. The available information does not indicate exploitation solely from receiving or storing the file.
Does an attacker need prior access or privileges on the affected system?
No privileges are required according to the provided CVSS vector. Exploitation relies on convincing a user to process the malicious file through GIMP.
Which GIMP functionality is involved?
The issue is in the file-paa plug-in used to load Bohemia Interactive PAA textures. Systems or workflows that process untrusted PAA files through this loader are the relevant exposure scenario.