CVE-2026-78465 Gimp: integer overflow in pcx loader (planes=4) leads to heap overflow on 32-bit

Description

A flaw was found in the file-pcx plugin in GIMP, affecting 32-bit builds only. When processing a PCX image file, the plugin calculates memory allocation sizes based on the image dimensions and the number of color planes. If a crafted file sets the number of planes to 4 alongside sufficiently large dimensions, the calculation exceeds the 32-bit integer limit and overflows, resulting in an undersized heap-based buffer allocation. This integer overflow issue results in a heap-based buffer overflow when the plugin subsequently writes image data into the undersized buffer, causing memory corruption, potentially leading to arbitrary code execution or a denial of service.

Exploitable with local access to the machine, without an account and if a user takes an action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector

Local

Attack complexity

High

Privileges required

None

Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected products and versions