CVE-2026-62439: Integer Overflow or Wraparound in Red Hat Red Hat Enterprise Linux 10

An integer overflow vulnerability exists in the GIMP file-pvr plug-in on Red Hat Enterprise Linux 10. The overflow occurs during the calculation of memory buffer sizes for image dimensions when processing PowerVR (.pvr) files. Exploitation requires user interaction to open or preview a maliciously crafted .pvr file, which triggers a heap-based buffer overflow. This can result in arbitrary code execution or application crash causing denial of service. The vulnerability has a CVSS 3.1 score of 7.0 with vector AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating local attack vector with high complexity and required user interaction.

Successful exploitation can lead to arbitrary code execution or denial of service (application crash). The attack requires local access and user interaction (opening or previewing a crafted .pvr file). Confidentiality, integrity, and availability impacts are all rated high due to the potential for code execution and service disruption.

No explicit patch or remediation status is provided in the vendor advisory link. Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-62439 for current remediation guidance. Until a fix is applied, avoid opening or previewing untrusted PowerVR (.pvr) files in GIMP on affected systems.