An integer overflow, leading to heap-based buffer overflow was found in the way portable pixmap format (PPM) image file format handler of GEGL, a graph based image processing framework, processed certain input PPM image file headers. A remote attacker could provide a specially-crafted PPM image that when opened in gegl executable would lead to crash, or, potentially arbitrary code execution with the privileges of the user running the binary.

This issue was found by Murray McAllister, Red Hat Security Response Team.

A flaw was found in GEGL. The Radiance HDR loader reads past the end of a memory-mapped image when an uncompressed scanline is shorter than the width declared in the file header. Opening a crafted HDR file crashes the application that uses the loader.

A flaw was found in GEGL's Radiance HDR (RGBE) image loader. rgbereaduncompressed() reads xaxis.size times 4 bytes from the memory-mapped file for every scanline and does not compare that length with the bytes remaining in the file. rgbergbetofloat() then loads those bytes. A crafted .hdr file whose declared image is larger than its scanline data can make the application that opens it crash. The pixel buffer is sized for the declared image, so this path is a read past the file mapping. It is distinct from the RLE output overflow tracked as CVE-2026-2050 and from the allocation overflow tracked as CVE-2026-18300: a height below the 32768-pixel cap still reaches the unbounded read.

An integer overflow, leading to heap-based buffer overflow was found in the way portable pixmap format (PPM) image file format handler of GEGL, a graph based image processing framework, processed certain input PPM image file headers. A remote attacker could provide a specially-crafted PPM image that when opened in gegl executable would lead to crash, or, potentially arbitrary code execution with the privileges of the user running the binary.

This issue was found by Murray McAllister, Red Hat Security Response Team.