CVE-2026-82330: Out-of-bounds Read in GNOME GIMP

The vulnerability CVE-2026-82330 affects GIMP version 3.2.0 in its file-pvr plugin. The VQ compressed decoder does not properly validate memory bounds when processing specially crafted PVR image files, resulting in a heap out-of-bounds read. This can cause the application to crash (denial of service) or disclose limited heap memory contents. Exploitation requires local user interaction to open a malicious file. The CVSS 3.1 score is 6.1 with attack vector local, low complexity, no privileges required, and user interaction required. Red Hat's advisory confirms the issue and rates it as moderate severity. No patch or official fix is currently available. The vendor advises not to open PVR files from untrusted sources to mitigate risk.

Successful exploitation can cause GIMP to crash, resulting in denial of service. Additionally, limited information disclosure of heap memory contents may occur, potentially leaking sensitive data such as memory addresses that could aid further attacks. The attack requires user interaction to open a malicious PVR file, which reduces the likelihood of exploitation. There is no indication of integrity impact or remote attack vector. No known exploits are reported in the wild.

No official patch or fix is currently confirmed by the vendor. The recommended mitigation is to avoid opening PVR image files from untrusted or unverified sources with GIMP. Users should exercise caution when handling PVR files until a fix is released. Monitor the vendor advisory for updates on patch availability.