CVE-2026-106065: Improper Restriction of Operations within the Bounds of a Memory Buffer in Red Hat Red Hat Enterprise Linux 10

This vulnerability involves a heap-based buffer overflow in GIMP's PCX export plug-in on Red Hat Enterprise Linux 10. Specifically, when exporting images with very large width and height, the buffer allocation calculation (width * height) overflows 32-bit arithmetic, causing the allocated buffer to be smaller than needed. Subsequent GEGL operations use the full image extent, leading to out-of-bounds memory operations. This improper restriction of operations within the bounds of the allocated memory buffer can result in memory corruption, affecting integrity and availability.

Successful exploitation can lead to memory corruption, causing denial of service or potential integrity issues within the affected system. There is no indication of confidentiality impact. The CVSS vector indicates local attack vector with high attack complexity and required user interaction, resulting in no confidentiality impact but high integrity and availability impact.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-106065 for current remediation guidance. No explicit patch or workaround information is provided in the available data.