Bug 2546654 (CVE-2026-106062)

Summary: CVE-2026-106062 gimp: GIMP: heap buffer overflow in DDS loader on crafted DirectDraw Surface file
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A heap-based buffer overflow was found in GIMP’s DirectDraw Surface (DDS) loader. When loading a crafted DDS image, buffer sizes derived from width, height, and pitch can be computed using 32-bit arithmetic that overflows. The allocated buffer is too small for the amount of pixel data written through GEGL, following integer overflow in size calculations. This may allow heap corruption and, in the worst case, arbitrary code execution in the context of the GIMP process.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2546659    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-06 16:11:09 UTC 
Same upstream issue, Finding 2. plug-ins/common/ddsread.c, read_dds() / load_layer() (~428–1313): pitch/buffer sizing with wrapped width * height (and related fields); GEGL writes past heap buffer. ASan-confirmed heap-buffer-overflow write. Vector: load crafted DDS file. Survives prior DDS fix CVE-2026-42170 (commit 7dff816) per reporter. CVSS tentative: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (7.8).