CVE-2026-106064 PUBLISHED

Gimp: gimp: heap buffer overflow in gif export on oversized image dimensions

Assigner: redhat
Reserved: 06.10.2026 Published: 07.10.2026 Updated: 07.10.2026

A heap-based buffer overflow was found in GIMP’s GIF export plug-in. Exporting an image with very large width and height can cause 32-bit overflow when computing the pixel buffer size. The plug-in allocates a buffer based on the wrapped value while GEGL writes using the true image extent, rooted in integer overflow

Metrics

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H
CVSS Score: 6.3

Product Status

Vendor Red Hat
Product Red Hat Enterprise Linux 10
Versions Default: unknown
Vendor Red Hat
Product Red Hat Enterprise Linux 6
Versions Default: unknown
Vendor Red Hat
Product Red Hat Enterprise Linux 7
Versions Default: unknown
Vendor Red Hat
Product Red Hat Enterprise Linux 8
Versions Default: unknown
Vendor Red Hat
Product Red Hat Enterprise Linux 9
Versions Default: unknown

Workarounds

Do not export untrusted high-resolution images to GIF; enforce maximum width/height in batch or scripted export pipelines

Credits

  • Red Hat would like to thank Jim Alves-Foss for reporting this issue.

References

Problem Types

  • Improper Restriction of Operations within the Bounds of a Memory Buffer CWE