CVE-2026-106064: Improper Restriction of Operations within the Bounds of a Memory Buffer in Red Hat Red Hat Enterprise Linux 10

This vulnerability involves an integer overflow when computing the pixel buffer size for GIF export in GIMP's plug-in on Red Hat Enterprise Linux 10. Specifically, exporting images with very large width and height values causes the 32-bit calculation to wrap, leading to a heap-based buffer overflow. The plug-in allocates memory based on the wrapped (incorrect) size, but GEGL writes data according to the true image dimensions, causing out-of-bounds writes and potential memory corruption.

Successful exploitation can lead to memory corruption, which may allow an attacker to cause a denial of service or potentially execute arbitrary code with the privileges of the user running the application. The CVSS score of 6.3 reflects a medium severity with high impact on integrity and availability, but requires local access with high attack complexity and user interaction.

The vendor advisory from Red Hat should be consulted for official remediation guidance. Patch status is not yet confirmed from the provided data; therefore, check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-106064 for current patch availability and mitigation instructions. Until patched, avoid exporting GIF images with extremely large dimensions using the affected plug-in.