CVE-2026-62438: Integer Overflow or Wraparound in Red Hat Red Hat Enterprise Linux 10
Description
CVE-2026-62438 is an integer overflow vulnerability in GIMP on Red Hat Enterprise Linux 10. It occurs when processing Bohemia Interactive (PAA) texture files, leading to undersized memory allocation and out-of-bounds reads. This can cause a denial of service or potential disclosure of sensitive memory contents when a user opens or previews a crafted file.
CVSS v3.1
Score 6.1medium
Affected software
Red Hat
Red Hat Enterprise Linux 10
Red Hat
Red Hat Enterprise Linux 6
Red Hat
Red Hat Enterprise Linux 7
Red Hat
Red Hat Enterprise Linux 8
Red Hat
Red Hat Enterprise Linux 9
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability arises from an integer overflow during the calculation of image dimensions in the decompression of PAA texture files in GIMP. The overflow causes the application to allocate a smaller-than-needed memory buffer. Subsequent processing reads beyond this buffer boundary, which can terminate the plug-in process unexpectedly and may leak sensitive memory data. The flaw requires user interaction to open or preview a maliciously crafted file.
Potential Impact
An attacker can cause a denial of service by crashing the plug-in process or potentially disclose sensitive memory contents. The attack vector requires local access with user interaction (opening or previewing a file). The CVSS 3.1 base score is 6.1 (medium severity), reflecting limited confidentiality impact and high availability impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-62438 for current remediation guidance. Until a patch is available, avoid opening or previewing untrusted PAA texture files in GIMP.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-07-14T11:54:34.302Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-62438","vendor":"Red Hat"}]
Threat ID: 6ad29f552cdf04f6563f4989
Added to database: 10/16/2026, 22:04:05 UTC
Last enriched: 10/16/2026, 22:18:22 UTC
Last updated: 10/16/2026, 22:19:05 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.