REDHAT-BUG-2525615: Medium severity GIMP file-pvr plugin vulnerability

Published Aug 28, 2026

Updated

A flaw was found in the file-pvr plugin in GIMP, affecting versions 3.2.0 and newer. When processing a specially crafted PVR image file, the VQ (compressed) decoder does not properly perform memory bounds checking. This missing validation results in a heap out-of-bounds read. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of heap memory contents.

Affected Software

1 affected component

GIMP file-pvr plugin>=undefined

Event History

Aug 28, 2026

Data Sourced

via Red Hat·02:38 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What must an attacker provide to trigger this issue?

The attacker must cause GIMP to process a specially crafted PVR image file. The vulnerable code is the VQ compressed-image decoder in the file-pvr plugin.

Which installations are affected?

GIMP versions 3.2.0 and newer are affected when the file-pvr plugin is present and processes PVR files.

What is the likely impact of successful exploitation?

The heap out-of-bounds read can crash the application, causing denial of service. It may also disclose a limited amount of heap memory contents.