CVE-2026-62438

Received Received - Intake

Integer Overflow in GIMP Leads to DoS or Memory Disclosure

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: redhat-SADP

Description

A flaw was found in GIMP. An attacker can cause a Denial of Service (DoS) or potentially disclose sensitive memory contents by convincing a user to open or preview a specially crafted Bohemia Interactive (PAA) texture file. Due to an integer overflow when calculating image dimensions during file decompression, the application allocates an undersized memory buffer. Subsequent processing reads memory past the buffer boundary, terminating the plug-in process unexpectedly.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-16

Last Modified

2026-10-16

Generated

2026-10-17

AI Q&A

2026-10-17

EPSS Evaluated

N/A

NVD

CVE-2026-62438

EUVD

EUVD-2026-103188

Affected Vendors & Products

Vendor	Product	Version / Range
Red	Hat	Red Hat Enterprise Linux 10 *
Red	Hat	Red Hat Enterprise Linux 7 *
Red	Hat	Red Hat Enterprise Linux 8 *
Red	Hat	Red Hat Enterprise Linux 9 *

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-190	The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

Executive Summary

This vulnerability is a flaw in GIMP where an attacker can cause a Denial of Service (DoS) or disclose sensitive memory contents by tricking a user into opening a specially crafted Bohemia Interactive (PAA) texture file. It occurs due to an integer overflow when calculating image dimensions during file decompression, leading to an undersized memory buffer. This causes the application to read memory past the buffer boundary, crashing the plug-in process.

Detection Guidance

This vulnerability involves a DoS or memory disclosure when processing specially crafted PAA texture files in GIMP due to an integer overflow. To detect it, monitor GIMP processes for crashes when opening PAA files. Check for unusual memory usage patterns during file decompression. No specific commands are provided in the context, but inspecting GIMP logs for segmentation faults or memory errors may indicate exploitation attempts.

Impact Analysis

If exploited, this vulnerability could crash GIMP when processing a malicious PAA file, disrupting your workflow. In some cases, it may also expose sensitive memory contents, potentially leaking information. Users should avoid opening untrusted PAA files to mitigate risk.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling memory disclosure or DoS attacks. Exposure of sensitive memory contents may lead to unauthorized data access, violating confidentiality requirements under these regulations. The DoS condition could disrupt critical operations, affecting availability obligations.

Mitigation Strategies

Update GIMP to the latest version to patch the integer overflow flaw in PAA texture file handling. Avoid opening untrusted PAA files or use a sandboxed environment for previewing such files.

Hi! I’m here to help you understand CVE-2026-62438. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70