Log in Start free

Vulnerability · Published Oct 7, 2026 · Assigned by redhat

CVE-2026-106061Gimp: gimp: heap buffer over-read in x cursor (xmc) thumbnail loader on crafted file

Medium 5.5

In plain English

A medium-severity out-of-bounds read in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.1%top 98.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in GIMP’s X cursor (XMC) thumbnail loader. When GIMP generates a thumbnail for a crafted XMC file, it allocates a pixel buffer using a width * height size computed in 32-bit signed arithmetic. If that product overflows, the allocation is smaller than the true image extent. A subsequent GEGL buffer read uses the unwrapped dimensions and performs an out-of-bounds read on the heap, after integer overflow in the size calculation. This can crash GIMP or corrupt process memory.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12gimpno fix listedDEBIAN-CVE-2026-106061
Debian:13gimpno fix listedDEBIAN-CVE-2026-106061
Debian:14gimpno fix listedDEBIAN-CVE-2026-106061
Ubuntu:26.04:LTSgimpno fix listedUBUNTU-CVE-2026-106061
Ubuntu:26.10gimpno fix listedUBUNTU-CVE-2026-106061

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 6 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references

Weakness: CWE-125 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References