Live › vulnerability › CVE-2026-62439
Go to dashboardGIMP's file-pvr plug-in computes image buffer sizes with an integer overflow, so a crafted .pvr file causes a heap-based buffer overflow. An attacker who gets a user to open or preview that file can run arbitrary code or crash GIMP.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Anyone who opens or previews PowerVR (.pvr) files in GIMP, typically desktop users and designers handling files from outside sources. Servers that only batch-process images without GIMP's file-pvr loader can skip it. The sources do not give the affected version range.
No product ranges from the sources yet.
gimp --version on each workstation or image-processing host and compare with the fixed release in the vendor advisoryEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for image dimensions. By tricking a user into opening or previewing a specially crafted PowerVR (.pvr) file, an attacker can trigger a heap-based buffer overflow, potentially leading to arbitrary code execution or a Denial of Service (DoS) via an application crash.
This page as .md · .json · in your agent: get_signal("CVE-2026-62439")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.