Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-08-04T00:19:42 gimp: GIMP DDS plug-in heap-based buffer overflow via BPP mismatch in load_layer() (ddsread.c) 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CWE-131

A heap-based buffer overflow vulnerability exists in the GIMP DDS (DirectDraw Surface) file parser. When a crafted DDS file declares a D3D9 pixel format but sets a lower bits-per-pixel (bpp) value in the header, the loader allocates an undersized heap buffer. Subsequent pixel data consumption at the real format's stride causes a write past the heap buffer boundary, leading to heap metadata corruption and potential code execution.

A heap-based buffer overflow vulnerability exists in the GIMP DDS (DirectDraw Surface) file parser. When a crafted DDS file declares a D3D9 pixel format but sets a lower bits-per-pixel (bpp) value in the header, the loader allocates an undersized heap buffer. Subsequent pixel data consumption at the real format's stride causes a write past the heap buffer boundary, leading to heap metadata corruption and potential code execution.

This heap-based buffer overflow vulnerability in the GIMP DDS plug-in could lead to heap metadata corruption and potential code execution. The flaw is triggered when a user opens a specially crafted DDS image file. Red Hat Enterprise Linux systems with GIMP installed are affected if users process untrusted DDS files. Red Hat would like to thank HanTul for reporting this issue. Users should avoid opening untrusted DirectDraw Surface (DDS) image files with GIMP. As a general security practice, only process files from trusted sources. If GIMP is not essential, consider removing the `gimp` package to eliminate this attack vector. Red Hat Enterprise Linux 6 Will not fix gimp Red Hat Enterprise Linux 7 Will not fix gimp Red Hat Enterprise Linux 8 Affected gimp:2.8/gimp Red Hat Enterprise Linux 9 Under investigation gimp https://www.cve.org/CVERecord?id=CVE-2026-42170 https://nvd.nist.gov/vuln/detail/CVE-2026-42170