Threats Tagged 'cve-2026-78465'

Multiple security vulnerabilities affecting GIMP, including remote code execution and arbitrary code execution via crafted image files, have been fixed in the gimp-3.2.6-1.1 package. These issues involve integer overflows, heap-based buffer overflows, and unsigned underflows in PSD, TIF, and SGI file parsing. The vulnerabilities were addressed in updates available for various architectures and distributions, including Red Hat Enterprise Linux 9. No known exploits in the wild have been reported.

These are all security issues fixed in the gimp-3.2.6-1.1 package on the GA media of openSUSE Tumbleweed.

CVE-2026-78465 is an integer overflow vulnerability in the file-pcx plugin of GIMP affecting only 32-bit builds. The flaw occurs when processing specially crafted PCX image files with 4 color planes and large dimensions, causing a 32-bit integer overflow during memory allocation size calculation. This leads to an undersized heap buffer allocation and subsequent heap-based buffer overflow when image data is written, resulting in memory corruption. Exploitation requires local user interaction to open a malicious PCX file. Successful exploitation may lead to arbitrary code execution or denial of service. Default security features like SELinux, ASLR, and NX reduce the likelihood of exploitation. No official patch or fix status is confirmed yet. Mitigation involves avoiding opening untrusted PCX files with GIMP.