Live › vulnerability › CVE-2026-62438
Go to dashboardGIMP's Bohemia Interactive PAA texture plug-in miscalculates image dimensions during decompression, so it allocates a buffer too small. Processing then reads past the buffer, which crashes the plug-in and may expose nearby memory contents.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Desktop users who open or preview PAA textures in GIMP, typically people working with Bohemia Interactive game assets such as Arma. Servers and teams that never open untrusted image files can skip it.
No product ranges from the sources yet.
gimp --version and compare against the fixed release in the NVD entry.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in GIMP. An attacker can cause a Denial of Service (DoS) or potentially disclose sensitive memory contents by convincing a user to open or preview a specially crafted Bohemia Interactive (PAA) texture file. Due to an integer overflow when calculating image dimensions during file decompression, the application allocates an undersized memory buffer. Subsequent processing reads memory past the buffer boundary, terminating the plug-in process unexpectedly.
This page as .md · .json · in your agent: get_signal("CVE-2026-62438")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.