Description

A flaw was found in the file-pcx plugin in GIMP, affecting 32-bit builds only. When processing a PCX image file, the plugin calculates memory allocation sizes based on the image dimensions and the number of color planes. If a crafted file sets the number of planes to 4 alongside sufficiently large dimensions, the calculation exceeds the 32-bit integer limit and overflows, resulting in an undersized heap-based buffer allocation. This integer overflow issue results in a heap-based buffer overflow when the plugin subsequently writes image data into the undersized buffer, causing memory corruption, potentially leading to arbitrary code execution or a denial of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.0",
  "pubDate": "2026-08-24T17:18:20.810Z",
  "pubdate": "2026-08-24T17:18:20.810Z",
  "executiveSummary": "An integer overflow vulnerability exists in the file-pcx plugin of GIMP, specifically affecting 32-bit builds. The vulnerability arises during the processing of crafted PCX image files where memory allocation sizes are improperly calculated based on image dimensions and the number of color planes. When an attacker supplies a malicious PCX file specifying 4 color planes alongside excessively large dimensions, the calculation exceeds the 32-bit integer limit, resulting in an integer wrap-around and an undersized heap-based buffer allocation. Subsequent write operations into this truncated buffer trigger a heap-based buffer overflow, corrupting memory.\nThe primary impact of this memory corruption includes potential arbitrary code execution within the context of the user running GIMP, or alternatively, application crashes resulting in a denial of service. The risk implications are moderate to high depending on user interaction and privileges. Successful exploitation requires an attacker to convince a victim to open a specially crafted PCX image file using a 32-bit build of GIMP, as 64-bit systems are not affected by this specific 32-bit integer boundary constraint. No authentication or elevated privileges are required, but local user interaction in opening the malicious file is necessary.",
  "technicalDetails": "The vulnerability resides in the file-pcx plugin responsible for parsing PCX image files within GIMP. The root cause of the flaw is an arithmetic integer overflow during the sizing calculation phase of memory allocation. Specifically, the plugin computes the required heap memory size by multiplying image dimensions by the number of color planes. In 32-bit builds, integer representations are constrained to 32 bits.\nThe attack flow proceeds as follows: First, an attacker crafts a malicious PCX file containing manipulated header metadata. This metadata sets the number of color planes to 4 and defines sufficiently large image dimensions (width and height). Second, when the vulnerable GIMP 32-bit build processes the PCX file, the plugin passes these dimensions and color plane values into the memory allocation sizing routine. Third, the multiplication operation exceeds the maximum limit of a 32-bit integer, causing an integer overflow condition. Because of the wrap-around, a small integer value is returned instead of the actual large size required.\nFourth, the application allocates a heap-based buffer using this undersized calculation result. Finally, when the plugin attempts to decode and write the full set of image pixel data into the newly allocated buffer, the input data size vastly exceeds the buffer capacity. This results in a classic heap-based buffer overflow, overwriting adjacent heap memory structures. Depending on the memory layout and heap management implementation, this memory corruption can allow an adversary to hijack control flow, potentially leading to arbitrary code execution or destabilizing the process to achieve a denial of service.\nThe vulnerability affects 32-bit builds of GIMP utilizing the file-pcx plugin. Exploitation requires no authentication or special privileges on the target system, though it relies entirely on local user interaction to open the untrusted PCX file. Network exposure is indirect, typically mediated through email attachments, file sharing, or malicious web downloads designed to deliver the crafted image file to the victim."
}