ZeroDay Findings
Sign inSign up

Findings

CVE-2026-78465

A flaw was found in the file-pcx plugin in GIMP, affecting 32-bit builds only.

Published Aug 24, 2026 · updated Oct 14, 2026 · gimp gimp

A flaw was found in the file-pcx plugin in GIMP, affecting 32-bit builds only. When processing a PCX image file, the plugin calculates memory allocation sizes based on the image dimensions and the number of color planes. If a crafted file sets the number of planes to 4 alongside sufficiently large dimensions, the calculation exceeds the 32-bit integer limit and overflows, resulting in an undersized heap-based buffer allocation. This integer overflow issue results in a heap-based buffer overflow when the plugin subsequently writes image data into the undersized buffer, causing memory corruption, potentially leading to arbitrary code execution or a denial of service.

Timeline

Detection, updates, and resolution for this record.

  1. Aug 24, 2026 · NIST NVD

    Detected

    A flaw was found in the file-pcx plugin in GIMP, affecting 32-bit builds only. When processing a PCX image file, the plugin calculates memory allocation sizes based on the image dimensions and the number of color planes. If a crafted file sets the number of planes to 4 alongside sufficiently large dimensions, the calculation exceeds the 32-bit integer limit and overflows, resulting in an undersize

  2. Oct 14, 2026 · NIST NVD

    Updated

    A flaw was found in the file-pcx plugin in GIMP, affecting 32-bit builds only. When processing a PCX image file, the plugin calculates memory allocation sizes based on the image dimensions and the number of color planes. If a crafted file sets the number of planes to 4 alongside sufficiently large dimensions, the calculation exceeds the 32-bit integer limit and overflows, resulting in an undersize

Affected

  • cpe gimp/gimpversion unspecified
  • cpe gimp/gimp3.3.1

Sources

  • CVE.orgCVE-2026-78465

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2026-78465

    30-day exploitation probability 0.3%

    first.org
  • NIST NVDCVE-2026-78465

    A flaw was found in the file-pcx plugin in GIMP, affecting 32-bit builds only. When processing a PCX image file, the plugin calculates memory allocation sizes based on the image dimensions and the number of color planes. If a crafted file sets the number of planes to 4 alongside

    nvd.nist.gov

References