CVE-2026-96544

{}

{}

{}

{"acknowledgement": "Upstream acknowledges Spektra as the original reporter.", "bugzilla": {"description": "gimp: gimp: integer overflow in the PVR image loader leads to an out-of-bounds heap read", "id": "2539572", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539572"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "status": "draft"}, "cwe": "CWE-190", "details": ["An integer overflow flaw was found in GIMP's PVR image loader. When a user opens a crafted PVR image, unchecked multiplication of attacker-controlled dimensions in pvr_decode_rect() can result in an undersized heap allocation followed by an out-of-bounds read. This may disclose adjacent heap contents through the decoded image or crash the file-pvr plug-in."], "mitigation": {"lang": "en:us", "value": "Do not open PVR image files from untrusted sources. No application-level mitigation that preserves processing of untrusted PVR files is known."}, "name": "CVE-2026-96544", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "gimp", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "gimp", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "gimp", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "gimp:2.8/gimp", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "gimp", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-09-19T16:58:10Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-96544\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-96544\nhttps://gitlab.gnome.org/GNOME/gimp/-/work_items/16790"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "gimp", "vendor": "gnome"}], "created": "2026-09-24T01:45:13.071164+00:00", "updated": "2026-09-24T02:00:14.482377+00:00", "vendors": ["gnome", "gnome$PRODUCT$gimp"]}