---
id: "CVE-2026-62438"
kind: "vulnerability"
aliases: ["CVE-2026-62438"]
title: "GIMP: crafted PAA texture file can crash or leak memory"
severity: "medium"
cvss: 6.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["desktop", "gimp", "image-files", "package"]
not_affected_if: ["no-paa-files", "no-untrusted-images"]
published_at: "2026-10-16T22:17:24+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T04:04:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62438", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# GIMP: crafted PAA texture file can crash or leak memory

GIMP's Bohemia Interactive PAA texture plug-in miscalculates image dimensions during decompression, so it allocates a buffer too small. Processing then reads past the buffer, which crashes the plug-in and may expose nearby memory contents.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `gimp --version` and compare against the fixed release in the NVD entry.
- Check whether the PAA file plug-in is installed (unknown which path the sources use).

## Fix

- Upgrade GIMP to a release that includes the upstream fix for CVE-2026-62438 (unknown version; see NVD).
- Until patched, do not open untrusted PAA texture files.

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-62438

## From the sources

A flaw was found in GIMP. An attacker can cause a Denial of Service (DoS) or potentially disclose sensitive memory contents by convincing a user to open or preview a specially crafted Bohemia Interactive (PAA) texture file. Due to an integer overflow when calculating image dimensions during file decompression, the application allocates an undersized memory buffer. Subsequent processing reads memory past the buffer boundary, terminating the plug-in process unexpectedly.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_