Vulnerability record/PUBLISHED/Published Oct 7, 2026 17:36:19 UTC
CVE-2026-106067
A heap-based buffer overflow was found in GIMP’s Hot color filter plug-in. For very large images, a pixel buffer is allocated using overflowing 32-bit width * height (and related) arithmetic while the filter’s pixel access path uses the true image size, after integer overflow in the allocation size
Base score6.3/ 10
SeverityMediumCVSS 3.1
Exploitability / impact
CVSS metric breakdown
Base severityMedium
Attack vectorLocalAV
Attack complexityHighAC
Privileges requiredNonePR
User interactionRequiredUI
ScopeUnchangedS
Confidentiality impactNoneC
Integrity impactHighI
Availability impactHighA
CVSS vector string
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:HCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering Authorityredhat
Last updatedNov 5, 2026 15:54:02 UTC
PublishedOct 7, 2026 17:36:19 UTC
ReservedOct 6, 2026 14:27:39 UTC
Credits
- Red Hat would like to thank Jim Alves-Foss for reporting this issue.