CVE-2026-78465: Gimp: integer overflow in pcx loader (planes=4) leads to heap overflow on 32-bit
A flaw was found in the file-pcx plugin in GIMP, affecting 32-bit builds only. When processing a PCX image file, the plugin calculates memory allocation sizes based on the image dimensions and the number of color planes. If a crafted file sets the number of planes to 4 alongside sufficiently large dimensions, the calculation exceeds the 32-bit integer limit and overflows, resulting in an undersized heap-based buffer allocation. This integer overflow issue results in a heap-based buffer overflow when the plugin subsequently writes image data into the undersized buffer, causing memory corruption, potentially leading to arbitrary code execution or a denial of service.
Other sources
A flaw was found in the file-pcx plugin in GIMP, affecting all versions on 32-bit builds only. When processing a PCX image file, the plugin calculates memory allocation sizes based on the image dimensions and the number of color planes. If a crafted file sets the number of planes to 4 alongside sufficiently large dimensions, the calculation exceeds the 32-bit integer limit and overflows, resulting in an undersized heap-based buffer allocation. This integer overflow issue results in a heap-based buffer overflow when the plugin subsequently writes image data into the undersized buffer, causing memory corruption, potentially leading to arbitrary code execution or a denial of service.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Which systems are affected?
Only 32-bit GIMP builds are affected. The issue is in the file-pcx plugin when it processes PCX image files.
What must an attacker do to trigger the flaw?
An attacker needs to provide a crafted PCX file with four color planes and sufficiently large image dimensions. Exploitation also requires a user to open or otherwise process that file with the vulnerable plugin.
Are normal PCX files affected?
The described condition requires a PCX file that declares four planes and uses dimensions large enough to overflow a 32-bit allocation-size calculation. The provided information does not indicate that ordinary PCX files trigger the issue.
How can I determine whether I may be exposed?
Identify whether GIMP is running as a 32-bit build and whether the file-pcx plugin is available or used to process PCX files. Systems that do not process untrusted PCX content have reduced exposure, but the provided data does not include a fixed-version or patch-status indicator.