{"id":"CVE-2026-62439","title":"Gimp: gimp: file-pvr plug-in pvr file parsing integer overflow heap-based buffer overflow vulnerability","summary":"A flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for image dimensions. By tricking a user into opening or previewing a specially crafted PowerVR (.pvr) file, an attacker ca…","severity":"high","cvss":7,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-190"],"vendor":"Red Hat","product":"gimp","affected":["gimp (all versions)","gimp","gimp (all versions)","gimp:2.8/gimp (all versions)","gimp (all versions)"],"published":"2026-10-16","updated":"2026-10-16","sourceUpdated":"2026-10-16T23:21:30.234Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-62439","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-62439"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2554464","label":"RHBZ#2554464"},{"url":"https://gitlab.gnome.org/GNOME/gimp/-/issues/16314"}],"tags":["cve.org"],"ingestedAt":"2026-10-16T22:54:45.857Z","slug":"CVE-2026-62439","body":"## Overview\n\nA flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for image dimensions. By tricking a user into opening or previewing a specially crafted PowerVR (.pvr) file, an attacker can trigger a heap-based buffer overflow, potentially leading to arbitrary code execution or a Denial of Service (DoS) via an application crash.\n\n## Affected\n\n- `gimp (all versions)`\n- `gimp`\n- `gimp (all versions)`\n- `gimp:2.8/gimp (all versions)`\n- `gimp (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":38.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}