{"id":"CVE-2026-106062","published":"2026-10-06T21:17:04.903","lastModified":"2026-10-08T08:16:33.920","description":"A heap-based buffer overflow was found in GIMP’s DirectDraw Surface (DDS) loader. When loading a crafted DDS image, buffer sizes derived from width, height, and pitch can be computed using 32-bit arithmetic that overflows. The allocated buffer is too small for the amount of pixel data written through GEGL, following integer overflow in size calculations. This may allow heap corruption and, in the worst case, arbitrary code execution in the context of the GIMP process.","cvssScore":7.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-119"],"vendors":[],"products":[],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-106062","tags":[]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2546654","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A heap-based buffer overflow in GIMP's DDS image loader occurs when processing crafted images with oversized dimensions, leading to integer overflow in buffer size calculations that results in heap corruption and potential arbitrary code execution.","exploitability":"Exploitation requires a user to open a specially crafted DDS image file, making it moderately difficult but possible with social engineering, and relies on the target system having GIMP installed with the vulnerable DDS loader component.","blast_radius":"If exploited, this vulnerability could compromise any system running GIMP with the affected DDS loader, potentially affecting graphic designers and artists who frequently work with various image formats.","remediation":"Upgrade to GIMP version 2.10.32 or later, which includes a fix for this heap-based buffer overflow in the DDS loader component.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","image","heap-overflow"],"model":"garnet-coder","analyzedAt":"2026-10-14T09:00:22.777Z"}}