Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

An integer overflow flaw was found in GIMP's PVR image loader. In pvr_decode_rect(), the PVR image width and height are promoted to signed int and multiplied when calculating the input and pixel-buffer allocation sizes. Crafted dimensions can overflow these calculations and produce small allocations, while gegl_buffer_set() is subsequently given the original large dimensions and reads far beyond the undersized pixel buffer. Heap contents following the buffer can be copied into the decoded image, potentially disclosing process memory, or the file-pvr plug-in can crash when the read reaches unmapped memory. The issue was reproduced with AddressSanitizer in GIMP 3.2.6, and the same code was present in the main branch. Versions 3.2.0 and later are affected. This is a follow-up to CVE-2026-62439: that fix added checked multiplication to pvr_decode_compressed(), but left the equivalent calculations in pvr_decode_rect() unchanged. A patch was available, but no fixed release had been identified at the time of reporting.