{"id":"CVE-2026-62438","kind":"vulnerability","aliases":["CVE-2026-62438"],"related":[],"title":"GIMP: crafted PAA texture file can crash or leak memory","description":"A flaw was found in GIMP. An attacker can cause a Denial of Service (DoS) or potentially disclose sensitive memory contents by convincing a user to open or preview a specially crafted Bohemia Interactive (PAA) texture file. Due to an integer overflow when calculating image dimensions during file decompression, the application allocates an undersized memory buffer. Subsequent processing reads memory past the buffer boundary, terminating the plug-in process unexpectedly.","summary":"GIMP's Bohemia Interactive PAA texture plug-in miscalculates image dimensions during decompression, so it allocates a buffer too small. Processing then reads past the buffer, which crashes the plug-in and may expose nearby memory contents.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop","gimp","image-files","package"],"not_affected_if":["no-paa-files","no-untrusted-images"],"how_to_check":"- Run `gimp --version` and compare against the fixed release in the NVD entry.\n- Check whether the PAA file plug-in is installed (unknown which path the sources use).","fix":"- Upgrade GIMP to a release that includes the upstream fix for CVE-2026-62438 (unknown version; see NVD).\n- Until patched, do not open untrusted PAA texture files.","status":"open","published_at":"2026-10-16T22:17:24+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T04:04:20+00:00","updated_at":"2026-10-25T04:04:20+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:04:20Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade GIMP to a release that includes the upstream fix for CVE-2026-62438 (unknown version; see NVD).\n- Until patched, do not open untrusted PAA texture files.","reach":"local","title":"GIMP: crafted PAA texture file can crash or leak memory","impact":"medium","summary":"GIMP's Bohemia Interactive PAA texture plug-in miscalculates image dimensions during decompression, so it allocates a buffer too small. Processing then reads past the buffer, which crashes the plug-in and may expose nearby memory contents.","category":"package","nicknames":[],"who_cares":["gimp","desktop","image-files"],"confidence":0.6,"needs_auth":"no","worst_case":"Plug-in crashes; nearby memory may be disclosed to the attacker.","analyst_note":"Find the fixed GIMP version and the upstream advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-62438 to fill in fix and how_to_check.","how_to_check":"- Run `gimp --version` and compare against the fixed release in the NVD entry.\n- Check whether the PAA file plug-in is installed (unknown which path the sources use).","needs_analyst":true,"not_affected_if":["no-paa-files","no-untrusted-images"],"who_is_affected":"Desktop users who open or preview PAA textures in GIMP, typically people working with Bohemia Interactive game assets such as Arma. Servers and teams that never open untrusted image files can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000617,"input_tokens":3347,"output_tokens":564,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-62438':13A,16A 'alloc':39B,113C 'applic':112C 'attack':69C 'bohemia':25B,94C 'boundari':125C 'buffer':41B,49B,117C,124C 'calcul':105C 'caus':71C 'content':61B,82C 'convinc':84C 'craft':2A,93C 'crash':7A,51B 'cve':11A,14A 'decompress':36B,110C 'denial':73C 'desktop':17B 'dimens':34B,107C 'disclos':79C 'dos':76C 'due':99C 'expos':58B 'file':5A,21B,98C,109C 'flaw':63C 'found':65C 'gimp':1A,18B,23B,67C 'imag':20B,33B,106C 'image-fil':19B 'integ':102C 'interact':26B,95C 'leak':9A 'may':57B 'memori':10A,60B,81C,116C,121C 'miscalcul':32B 'nearbi':59B 'open':88C 'overflow':103C 'paa':3A,27B,96C 'packag':22B 'past':47B,122C 'plug':30B,54B,129C 'plug-in':29B,53B,128C 'potenti':78C 'preview':90C 'process':44B,119C,131C 'read':46B,120C 'sensit':80C 'servic':75C 'small':43B 'special':92C 'subsequ':118C 'termin':126C 'textur':4A,28B,97C 'unders':115C 'unexpect':132C 'user':86C","nicknames":[],"mitigations":[],"who_affected":"Desktop users who open or preview PAA textures in GIMP, typically people working with Bohemia Interactive game assets such as Arma. Servers and teams that never open untrusted image files can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T22:17:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62438","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62438","severity":null,"published_at":"2026-10-16T22:17:24+00:00","modified_at":"2026-10-19T21:03:27+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}