[Pkg-gnome-extras-maintainers] Bug#1150242: gimp: CVE-2026-106062

[Salvatore Bonaccorso]

Source: gimp
Version: 3.2.6-1
X-Debbugs-CC: team at security.debian.org
Severity: important
Tags: security upstream

Hi,

The following vulnerability was published for gimp.

CVE-2026-106062[0]:
| A heap-based buffer overflow was found in GIMP’s DirectDraw Surface
| (DDS) loader. When loading a crafted DDS image, buffer sizes derived
| from width, height, and pitch can be computed using 32-bit
| arithmetic that overflows. The allocated buffer is too small for the
| amount of pixel data written through GEGL (CWE-787), following
| integer overflow in size calculations (CWE-190). This may allow heap
| corruption and, in the worst case, arbitrary code execution in the
| context of the GIMP process.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-106062
    https://www.cve.org/CVERecord?id=CVE-2026-106062
[1] https://bugzilla.redhat.com/show_bug.cgi?id=2546654
[2] https://gitlab.gnome.org/GNOME/gimp/-/work_items/16801
[3] https://gitlab.gnome.org/GNOME/gimp/-/merge_requests/3045

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore