[Pkg-gnome-extras-maintainers] Bug#1142990: gimp: CVE-2026-66757

[Salvatore Bonaccorso]

Source: gimp
Version: 3.2.4-3
Severity: important
Tags: security upstream
Forwarded: https://gitlab.gnome.org/GNOME/gimp/-/work_items/16494
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerability was published for gimp.

CVE-2026-66757[0]:
| A flaw was found in the file-sgi plugin in GIMP. When processing an
| RLE-compressed SGI image, the plugin allocates memory for a row
| table. The image header dimensions (ysize and zsize) are read as
| 16-bit unsigned integers. If a crafted file sets both dimensions to
| their maximum value (65535), the multiplication ysize * zsize
| overflows the standard 32-bit int boundary before being passed to
| calloc. This integer overflow issue results in undefined behavior,
| aborting the plugin and causing a denial of service.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-66757
    https://www.cve.org/CVERecord?id=CVE-2026-66757
[1] https://gitlab.gnome.org/GNOME/gimp/-/work_items/16494
[2] https://gitlab.gnome.org/GNOME/gimp/-/merge_requests/2884

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore