gimp: A flaw was found in the file-pcx plugin in GIMP, affecting 32-bit builds only
CVE-2026-78465 is fixed in gimp on 1 platform, first by OPENSUSE-SU-2026:21869-1, released September 16, 2026. It is not reported as exploited. Patch Radar priority: High.
A flaw was found in the file-pcx plugin in GIMP, affecting 32-bit builds only. When processing a PCX image file, the plugin calculates memory allocation sizes based on the image dimensions and the number of color planes. If a crafted file sets the number of planes to 4 alongside sufficiently large dimensions, the calculation exceeds the 32-bit integer limit and overflows, resulting in an undersized heap-based buffer allocation. This integer overflow issue results in a heap-based buffer overflow when the plugin subsequently writes image data into the undersized buffer, causing memory corruption, potentially leading to arbitrary code execution or a denial of service.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| gimp · Debian 13.5 (trixie) | 3.0.4-3+deb13u11 | DEBIAN-CVE-2026-78465 | Sep 18, 2026 |
| gimp · Debian 14 | 3.2.6-1 | DEBIAN-CVE-2026-78465 | Sep 18, 2026 |
| gimp · opensuse-leap 16.0 | 3.0.8-bp160.9.1 | OPENSUSE-SU-2026:21869-1 | Sep 16, 2026 |
| gimp · sles 15.7 | 2.10.30-150400.3.74.1 | SUSE-SU-2026:4309-1 | Sep 23, 2026 |