Threats Tagged 'cve-2026-82330'

Multiple security vulnerabilities affecting GIMP, including remote code execution and arbitrary code execution via crafted image files, have been fixed in the gimp-3.2.6-1.1 package. These issues involve integer overflows, heap-based buffer overflows, and unsigned underflows in PSD, TIF, and SGI file parsing. The vulnerabilities were addressed in updates available for various architectures and distributions, including Red Hat Enterprise Linux 9. No known exploits in the wild have been reported.

These are all security issues fixed in the gimp-3.2.6-1.1 package on the GA media of openSUSE Tumbleweed.

CVE-2026-82330 is a heap out-of-bounds read vulnerability in the file-pvr plugin of GIMP 3.2.0. It occurs when processing specially crafted PVR image files due to missing memory bounds checks in the VQ compressed decoder. This flaw can cause application crashes leading to denial of service or limited disclosure of heap memory contents. Exploitation requires convincing a user to open a malicious PVR file, reducing the likelihood of attack. The vulnerability has a medium severity rating with a CVSS score of 6.1. No official fix or patch is currently confirmed by the vendor. The recommended mitigation is to avoid opening PVR files from untrusted sources.