CVE-2026-62439: Gimp: gimp: file-pvr plug-in pvr file parsing integer overflow heap-based buffer overflow vulnerability
A flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for image dimensions. By tricking a user into opening or previewing a specially crafted PowerVR (.pvr) file, an attacker can trigger a heap-based buffer overflow, potentially leading to arbitrary code execution or a Denial of Service (DoS) via an application crash.
Other sources
GIMP ships a plug-in (file-pvr) that loads textures stored in the PowerVR (.pvr) texture format. Inside pvrdecodecompressed (the helper used for the four compressed-VQ data formats), the size of the destination pixel buffer is computed in 32-bit int arithmetic from the file's declared width, height, and a derived component count. For attacker-chosen 16-bit dimension pairs (e.g. width = 32 768, height = 32 769) and an alpha-bearing pixel mode (MODEARGB1555 or MODEARGB4444), the product width × height × ncomponents overflows INTMAX and wraps to a small positive value — 131 072 bytes for the demonstrated trigger. The function allocates that much memory and then writes into it using the original (large) width × ncomponents row stride, producing a heap-based buffer overflow write at the very first row past the allocated boundary. The dispatcher in loadimage does perform a bounds check (mipmapwidth >= MAXTWIDDLESIZE and mipmapheight >= MAXTWIDDLESIZE), but for dataformat == MODECOMPRESSEDMIPMAP (or MODESMALLVQMIPMAP) that check applies only to the auto-derived mipmap dimensions, not to the file's width/height values that are passed unchecked into pvrdecodecompressed. This is the gap that makes the integer overflow reachable. Triggering the vulnerability requires only that the user open or thumbnail a crafted .pvr file in GIMP — for example by double-clicking the file, dragging it into GIMP, or via any indexer that invokes GIMP's file-thumbnailer backend. The bug is a heap write (CWE-787) of attacker-influenced bytes off the end of an undersized buffer; the writes are short (1 byte at a time per component) but their starting offset and surrounding contents are derived from data that the attacker fully controls (the codebook bytes in the PVR file). This makes the bug a strong candidate for heap corruption / arbitrary write primitive that may be developed into remote code execution. At minimum it provides reliable denial-of-service via plug-in crash.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What user action is needed for exploitation?
An attacker must trick a user into opening or previewing a specially crafted PowerVR (.pvr) file in GIMP. The attack does not require attacker privileges, but it does require user interaction.
Which GIMP component and file types are involved?
The issue is in GIMP's file-pvr plug-in, which loads textures in the PowerVR (.pvr) format. The vulnerable parsing path is pvr_decode_compressed for compressed-VQ data formats.
What file characteristics trigger the overflow?
The malicious file declares attacker-controlled image dimensions that cause a 32-bit destination-buffer size calculation to overflow. The described trigger uses dimensions such as 32,768 by 32,769 with an alpha-bearing mode, including MODE_ARGB1555 or MODE_ARGB4444.
What is the potential impact after a successful trigger?
The undersized allocation is followed by writes using the original large image stride, causing a heap-based buffer overflow. This can potentially result in arbitrary code execution or a denial of service through an application crash.