CVE-2026-62438— Gimp: gimp: paa integer overflow out-of-bounds read
Quick assessment
Affected
Red Hat Red Hat Enterprise Linux 10
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
GIMP 中存在一个漏洞。攻击者可通过诱使用户打开或预览一个特制的 Bohemia Interactive（PAA）纹理文件，导致拒绝服务（DoS）或潜在泄露敏感内存内容。在文件解压缩过程中计算图像尺寸时发生整数溢出，导致应用程序分配了一个尺寸不足的内存缓冲区。随后的处理会读取超出该缓冲区边界的内存，从而意外终止插件进程。
Possible ATT&CK Techniques 2 AI
T1068 · Exploitation for Privilege Escalation T1203 · Exploitation for Client Execution
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-62438
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Gimp: gimp: paa integer overflow out-of-bounds read
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in GIMP. An attacker can cause a Denial of Service (DoS) or potentially disclose sensitive memory contents by convincing a user to open or preview a specially crafted Bohemia Interactive (PAA) texture file. Due to an integer overflow when calculating image dimensions during file decompression, the application allocates an undersized memory buffer. Subsequent processing reads memory past the buffer boundary, terminating the plug-in process unexpectedly.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
整数溢出或超界折返
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | - |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 6 | - |
cpe:/o:redhat:enterprise_linux:6
|
|
| Red Hat | Red Hat Enterprise Linux 7 | - |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 | - |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 | - |
cpe:/o:redhat:enterprise_linux:9
|
|
II. Public POCs for CVE-2026-62438
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-62438
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-62438 (2)
-
-
🔗 2554456 – (CVE-2026-62438) CVE-2026-62438 gimp: gimp: PAA integer overflow out-of-bounds read issue-tracking x_refsource_REDHAT
Other References for CVE-2026-62438 (1)
Same Patch Batch · Red Hat · 2026-10-16 · 15 CVEs total
| CVE-2026-104715 | 7.8 HIGH | Cifs-utils: mount.cifs credential-file option injection allows local privilege boundary by |
| CVE-2026-105958 | 7.5 HIGH | Spice-server: spice: heap oob read/write via unchecked migration data offsets |
| CVE-2026-105959 | 7.5 HIGH | Spice-server: spice: heap buffer overflow via glz dictionary max_encoders integer truncati |
| CVE-2026-62439 | 7.0 HIGH | Gimp: gimp: file-pvr plug-in pvr file parsing integer overflow heap-based buffer overflow |
| CVE-2026-89085 | 6.6 MEDIUM | Parted: parted: heap-based buffer overflow via crafted fat32 filesystem image |
| CVE-2026-111802 | 6.6 MEDIUM | Nautilus: nautilus: arbitrary file deletion via trash symlink |
| CVE-2026-85231 | 6.5 MEDIUM | Libtirpc: libtirpc: denial of service via unbounded memory allocation during rpcsec_gss de |
| CVE-2026-111555 | 6.0 MEDIUM | Luksmeta: missing slot-range validation permits out-of-gap device i/o |
| CVE-2026-89096 | 5.9 MEDIUM | Nfs-utils: nfs-utils: denial of service via memory leak in rpc.statd |
| CVE-2026-89088 | 5.5 MEDIUM | Parted: parted: denial of service via heap buffer overflow during fat16 resize |
| CVE-2026-89098 | 5.5 MEDIUM | Nfs-utils: nfs-utils: denial of service via assertion failure in fsidd |
| CVE-2026-85977 | 5.3 MEDIUM | Libtirpc: libtirpc: denial of service via unbounded memory allocation during portmapper re |
| CVE-2026-17591 | 3.6 LOW | Libarchive: libarchive: use-after-free via aliased mac metadata copy |
| CVE-2026-111581 | 3.3 LOW | Libblockdev: libblockdev: argument injection in ntfs/vfat label-setting helpers via udisks |
IV. Related Vulnerabilities
Same product: Red Hat Enterprise Linux 10
-
CVE-2026-89096
Nfs-utils: nfs-utils: denial of service via memory leak in r -
CVE-2026-89088
Parted: parted: denial of service via heap buffer overflow d -
CVE-2026-89085
Parted: parted: heap-based buffer overflow via crafted fat32 -
CVE-2026-111802
Nautilus: nautilus: arbitrary file deletion via trash symlin -
CVE-2026-17591
Libarchive: libarchive: use-after-free via aliased mac metad
Same vendor: Red Hat
-
CVE-2026-89096
Nfs-utils: nfs-utils: denial of service via memory leak in r -
CVE-2026-89088
Parted: parted: denial of service via heap buffer overflow d -
CVE-2026-89085
Parted: parted: heap-based buffer overflow via crafted fat32 -
CVE-2026-111802
Nautilus: nautilus: arbitrary file deletion via trash symlin -
CVE-2026-17591
Libarchive: libarchive: use-after-free via aliased mac metad
Same weakness: CWE-190
-
CVE-2026-62439
Gimp: gimp: file-pvr plug-in pvr file parsing integer overfl -
CVE-2026-102834
JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infi -
CVE-2026-102692
RIOT: Potential integer overflow in nanocoap Block2 handling -
CVE-2026-57488
pupnp: Integer truncation in HTTP Content-Length parsing ena -
CVE-2026-105959
Spice-server: spice: heap buffer overflow via glz dictionary
V. Comments for CVE-2026-62438
No comments yet