CVE-2026-62439

Received Received - Intake

Integer Overflow in GIMP via PVR File Handling

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: redhat-SADP

Description

A flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for image dimensions. By tricking a user into opening or previewing a specially crafted PowerVR (.pvr) file, an attacker can trigger a heap-based buffer overflow, potentially leading to arbitrary code execution or a Denial of Service (DoS) via an application crash.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-16

Last Modified

2026-10-16

Generated

2026-10-17

AI Q&A

2026-10-17

EPSS Evaluated

N/A

NVD

CVE-2026-62439

EUVD

EUVD-2026-103187

Affected Vendors & Products

Vendor	Product	Version / Range
Red	Hat	Red Hat Enterprise Linux 10 *
Red	Hat	Red Hat Enterprise Linux 7 *
Red	Hat	Red Hat Enterprise Linux 8 *
Red	Hat	Red Hat Enterprise Linux 9 *

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-190	The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

Executive Summary

This vulnerability is an integer overflow in GIMP's file-pvr plug-in. It occurs when calculating memory buffer sizes for image dimensions in a PowerVR (.pvr) file. An attacker can exploit this by tricking a user into opening or previewing a specially crafted file, leading to a heap-based buffer overflow.

Detection Guidance

This vulnerability can be detected by checking for GIMP installations and verifying if the file-pvr plugin is present. Inspect GIMP version and plugin files for potential integer overflow issues in PVR file handling. No specific commands are provided in the context.

Impact Analysis

This flaw may allow an attacker to execute arbitrary code or crash the application via a Denial of Service. Successful exploitation requires user interaction, such as opening a malicious .pvr file.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling arbitrary code execution or DoS attacks through crafted .pvr files. Such attacks may lead to unauthorized data access, modification, or disruption of systems handling personal or health data, violating confidentiality and integrity requirements.

Mitigation Strategies

Update GIMP to the latest version to patch the integer overflow flaw in the file-pvr plug-in. Avoid opening untrusted PowerVR (.pvr) files from unknown sources.

Hi! I’m here to help you understand CVE-2026-62439. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70