CVE-2026-78465

gimp: A flaw was found in the file-pcx plugin in GIMP, affecting 32-bit builds only

CVE-2026-78465 is fixed in gimp on 1 platform, first by OPENSUSE-SU-2026:21869-1, released September 16, 2026. It is not reported as exploited. Patch Radar priority: High.

High
CVSS
7.0
high
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0028
20th percentile

A flaw was found in the file-pcx plugin in GIMP, affecting 32-bit builds only. When processing a PCX image file, the plugin calculates memory allocation sizes based on the image dimensions and the number of color planes. If a crafted file sets the number of planes to 4 alongside sufficiently large dimensions, the calculation exceeds the 32-bit integer limit and overflows, resulting in an undersized heap-based buffer allocation. This integer overflow issue results in a heap-based buffer overflow when the plugin subsequently writes image data into the undersized buffer, causing memory corruption, potentially leading to arbitrary code execution or a denial of service.

Where it's fixed

ProductFixed inFixReleased
Linux
gimp · Debian 13.5 (trixie) 3.0.4-3+deb13u11 DEBIAN-CVE-2026-78465 Sep 18, 2026
gimp · Debian 14 3.2.6-1 DEBIAN-CVE-2026-78465 Sep 18, 2026
gimp · opensuse-leap 16.0 3.0.8-bp160.9.1 OPENSUSE-SU-2026:21869-1 Sep 16, 2026
gimp · sles 15.7 2.10.30-150400.3.74.1 SUSE-SU-2026:4309-1 Sep 23, 2026