Bug 2539392 (CVE-2026-96543)

Summary: CVE-2026-96543 gimp: gimp: out-of-bounds heap write when loading non-square PVR images
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
An out-of-bounds heap write flaw was found in GIMP's PVR image loader. When loading a crafted non-square PVR texture, pvr_decode_twiddle() can write attacker-controlled pixel data beyond the end of a correctly allocated heap buffer because the destination offset is not bounds-checked. A local attacker can exploit this by convincing a user to open a malicious PVR image, potentially causing arbitrary code execution in the file-pvr plug-in process.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2539562    
Bug Blocks:    

Description OSIDB Bzimport 2026-09-23 12:46:43 UTC 
An out-of-bounds heap write flaw was found in GIMP's PVR image loader. The pvr_decode_twiddle() function checks that its source offset remains within the attacker-supplied file data, but it does not check that the destination offset remains within the allocated pixel buffer. For non-square textures whose height is not a multiple of the width, the traversal advances beyond the correctly sized destination buffer and writes file-derived pixel data out of bounds. An attacker can control the texture dimensions, overflow length, heap allocation size class, and the values written from the PVR file. Opening a crafted PVR image can therefore corrupt adjacent heap objects in the file-pvr plug-in process, potentially resulting in arbitrary code execution. The upstream report reproduced the issue with AddressSanitizer in GIMP 3.2.6 and found identical code in the main branch. Versions 3.2.0 and later are affected. This is distinct from GIMP issue 16326 because the allocation size does not wrap; the defect is the unchecked destination traversal. A patch was available, but no fixed release had been identified at the time of reporting.