A flaw was found in the file-pvr plugin in GIMP. (CVE-2026-82330)

CVE-2026-82330 describes a vulnerability in the file-pvr plugin of GIMP where the VQ (compressed) decoder fails to properly perform memory bounds checking on specially crafted PVR image files. This missing validation leads to a heap out-of-bounds read, which can cause application crashes or limited information disclosure of heap memory. The vulnerability affects numerous explicitly listed GIMP versions, primarily in the 2.8.x, 2.10.x, 3.0.x, and 3.2.x series as detailed in the affectedVersions field. The CVSS 3.1 vector is AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H, reflecting local attack vector, low complexity, no privileges required, user interaction required, unchanged scope, low confidentiality impact, no integrity impact, and high availability impact.

Successful exploitation can cause GIMP to crash, resulting in denial of service. Additionally, there is a limited risk of information disclosure from heap memory contents. The impact does not include integrity compromise but affects availability and confidentiality to a limited extent.

No explicit patch or remediation information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid opening untrusted PVR image files with GIMP to mitigate risk.