CVE-2026-62439— Gimp: gimp: file-pvr plug-in pvr file parsing integer overflow heap-based buffer overflow vulnerability
Quick assessment
Affected
Red Hat Red Hat Enterprise Linux 10
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 GIMP 中发现一个安全漏洞。当计算图像维度的内存缓冲区大小时，file-pvr 插件中会发生整数溢出。攻击者可通过诱使用户打开或预览一个特制的 PowerVR（.pvr）文件，触发基于堆的缓冲区溢出，可能导致任意代码执行，或引发应用程序崩溃从而造成拒绝服务（DoS）。
Possible ATT&CK Techniques 2 AI
T1190 · Exploit Public-Facing Application T1203 · Exploitation for Client ExecutionAffected Version Matrix 5
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 6 | any |
unknown |
| Red Hat | Red Hat Enterprise Linux 7 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 8 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 9 | any |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-62439
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Gimp: gimp: file-pvr plug-in pvr file parsing integer overflow heap-based buffer overflow vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for image dimensions. By tricking a user into opening or previewing a specially crafted PowerVR (.pvr) file, an attacker can trigger a heap-based buffer overflow, potentially leading to arbitrary code execution or a Denial of Service (DoS) via an application crash.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
整数溢出或超界折返
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | - |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 6 | - |
cpe:/o:redhat:enterprise_linux:6
|
|
| Red Hat | Red Hat Enterprise Linux 7 | - |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 | - |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 | - |
cpe:/o:redhat:enterprise_linux:9
|
|
II. Public POCs for CVE-2026-62439
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-62439
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-62439 (2)
Other References for CVE-2026-62439 (1)
Same Patch Batch · Red Hat · 2026-10-16 · 15 CVEs total
| CVE-2026-104715 | 7.8 HIGH | Cifs-utils: mount.cifs credential-file option injection allows local privilege boundary by |
| CVE-2026-105958 | 7.5 HIGH | Spice-server: spice: heap oob read/write via unchecked migration data offsets |
| CVE-2026-105959 | 7.5 HIGH | Spice-server: spice: heap buffer overflow via glz dictionary max_encoders integer truncati |
| CVE-2026-89085 | 6.6 MEDIUM | Parted: parted: heap-based buffer overflow via crafted fat32 filesystem image |
| CVE-2026-111802 | 6.6 MEDIUM | Nautilus: nautilus: arbitrary file deletion via trash symlink |
| CVE-2026-85231 | 6.5 MEDIUM | Libtirpc: libtirpc: denial of service via unbounded memory allocation during rpcsec_gss de |
| CVE-2026-62438 | 6.1 MEDIUM | Gimp: gimp: paa integer overflow out-of-bounds read |
| CVE-2026-111555 | 6.0 MEDIUM | Luksmeta: missing slot-range validation permits out-of-gap device i/o |
| CVE-2026-89096 | 5.9 MEDIUM | Nfs-utils: nfs-utils: denial of service via memory leak in rpc.statd |
| CVE-2026-89088 | 5.5 MEDIUM | Parted: parted: denial of service via heap buffer overflow during fat16 resize |
| CVE-2026-89098 | 5.5 MEDIUM | Nfs-utils: nfs-utils: denial of service via assertion failure in fsidd |
| CVE-2026-85977 | 5.3 MEDIUM | Libtirpc: libtirpc: denial of service via unbounded memory allocation during portmapper re |
| CVE-2026-17591 | 3.6 LOW | Libarchive: libarchive: use-after-free via aliased mac metadata copy |
| CVE-2026-111581 | 3.3 LOW | Libblockdev: libblockdev: argument injection in ntfs/vfat label-setting helpers via udisks |
IV. Related Vulnerabilities
Same product: Red Hat Enterprise Linux 10
-
CVE-2026-89096
Nfs-utils: nfs-utils: denial of service via memory leak in r -
CVE-2026-89088
Parted: parted: denial of service via heap buffer overflow d -
CVE-2026-89085
Parted: parted: heap-based buffer overflow via crafted fat32 -
CVE-2026-111802
Nautilus: nautilus: arbitrary file deletion via trash symlin -
CVE-2026-62438
Gimp: gimp: paa integer overflow out-of-bounds read
Same vendor: Red Hat
-
CVE-2026-89096
Nfs-utils: nfs-utils: denial of service via memory leak in r -
CVE-2026-89088
Parted: parted: denial of service via heap buffer overflow d -
CVE-2026-89085
Parted: parted: heap-based buffer overflow via crafted fat32 -
CVE-2026-111802
Nautilus: nautilus: arbitrary file deletion via trash symlin -
CVE-2026-17591
Libarchive: libarchive: use-after-free via aliased mac metad
Same weakness: CWE-190
-
CVE-2026-112052
libspatialite through 5.1.0 Integer Overflow in WKB Geometry -
CVE-2026-112011
libtta through 2.3 Integer Overflow via tta_decoder_init_get -
CVE-2026-62438
Gimp: gimp: paa integer overflow out-of-bounds read -
CVE-2026-102834
JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infi -
CVE-2026-102692
RIOT: Potential integer overflow in nanocoap Block2 handling
V. Comments for CVE-2026-62439
No comments yet