Vulnerability record/PUBLISHED/Published Oct 6, 2026 19:34:29 UTC
CVE-2026-106063
A heap-based buffer overflow was found in GIMP’s DICOM export plug-in. When exporting an image with extremely large width and height, the export path allocates a buffer using a 32-bit width * height (and bytes-per-pixel) product that can overflow. GEGL then writes the full uncompressed extent into the undersized buffer, after integer overflow in the allocation size
Base score6.3/ 10
SeverityMediumCVSS 3.1
Exploitability / impact
CVSS metric breakdown
Base severityMedium
Attack vectorLocalAV
Attack complexityHighAC
Privileges requiredNonePR
User interactionRequiredUI
ScopeUnchangedS
Confidentiality impactNoneC
Integrity impactHighI
Availability impactHighA
CVSS vector string
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:HCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering Authorityredhat
Last updatedNov 5, 2026 15:53:55 UTC
PublishedOct 6, 2026 19:34:29 UTC
ReservedOct 6, 2026 14:27:03 UTC
Credits
- Red Hat would like to thank Jim Alves-Foss for reporting this issue.