CVE-2026-106062
A heap-based buffer overflow was found in GIMP’s DirectDraw Surface (DDS) loader.
Published Oct 6, 2026 · updated Oct 14, 2026
A heap-based buffer overflow was found in GIMP’s DirectDraw Surface (DDS) loader. When loading a crafted DDS image, buffer sizes derived from width, height, and pitch can be computed using 32-bit arithmetic that overflows. The allocated buffer is too small for the amount of pixel data written through GEGL, following integer overflow in size calculations. This may allow heap corruption and, in the worst case, arbitrary code execution in the context of the GIMP process.
Timeline
Detection, updates, and resolution for this record.
Oct 6, 2026 · NIST NVD
Detected
A heap-based buffer overflow was found in GIMP’s DirectDraw Surface (DDS) loader. When loading a crafted DDS image, buffer sizes derived from width, height, and pitch can be computed using 32-bit arithmetic that overflows. The allocated buffer is too small for the amount of pixel data written through GEGL, following integer overflow in size calculations. This may allow heap corruption and, in the
Oct 14, 2026 · NIST NVD
Updated
A heap-based buffer overflow was found in GIMP’s DirectDraw Surface (DDS) loader. When loading a crafted DDS image, buffer sizes derived from width, height, and pitch can be computed using 32-bit arithmetic that overflows. The allocated buffer is too small for the amount of pixel data written through GEGL, following integer overflow in size calculations. This may allow heap corruption and, in the
Sources
- CVE.orgCVE-2026-106062
Official CVE identifier
cve.org - FIRST EPSSCVE-2026-106062
30-day exploitation probability 0.1%
first.org - NIST NVDCVE-2026-106062
A heap-based buffer overflow was found in GIMP’s DirectDraw Surface (DDS) loader. When loading a crafted DDS image, buffer sizes derived from width, height, and pitch can be computed using 32-bit arithmetic that overflows. The allocated buffer is too small for the amount of pixel
nvd.nist.gov