CVE-2026-78465

{"id": "CVE-2026-78465", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-78465", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-24T18:00:09.876826Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.0, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.0}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"vendor": "GNOME", "product": "GIMP", "packageName": "gimp", "collectionURL": "https://gitlab.gnome.org/GNOME/gimp", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:6"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6", "packageName": "gimp", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unknown"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:7"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "packageName": "gimp", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:8"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "packageName": "gimp:2.8/gimp", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:9"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "packageName": "gimp", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}]}], "published": "2026-08-24T17:18:20.810", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-78465", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522057", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://gitlab.gnome.org/GNOME/gimp/-/work_items/16578", "tags": ["Issue Tracking", "Vendor Advisory", "Exploit", "Mitigation"], "source": "secalert@redhat.com"}, {"url": "https://gitlab.gnome.org/GNOME/gimp/-/work_items/16578", "tags": ["Issue Tracking", "Vendor Advisory", "Exploit", "Mitigation"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in the file-pcx plugin in GIMP, affecting 32-bit builds only. When processing a PCX image file, the plugin calculates memory allocation sizes based on the image dimensions and the number of color planes. If a crafted file sets the number of planes to 4 alongside sufficiently large dimensions, the calculation exceeds the 32-bit integer limit and overflows, resulting in an undersized heap-based buffer allocation. This integer overflow issue results in a heap-based buffer overflow when the plugin subsequently writes image data into the undersized buffer, causing memory corruption, potentially leading to arbitrary code execution or a denial of service."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en el plugin file-pcx en GIMP, que afecta solo a las compilaciones de 32 bits. Al procesar un archivo de imagen PCX, el plugin calcula los tama\u00f1os de asignaci\u00f3n de memoria bas\u00e1ndose en las dimensiones de la imagen y el n\u00famero de planos de color. Si un archivo manipulado establece el n\u00famero de planos en 4 junto con dimensiones suficientemente gryes, el c\u00e1lculo excede el l\u00edmite de entero de 32 bits y se desborda, lo que resulta en una asignaci\u00f3n de b\u00fafer basada en mont\u00edculo de tama\u00f1o insuficiente. Este problema de desbordamiento de entero resulta en un desbordamiento de b\u00fafer basado en mont\u00edculo cuando el plugin escribe posteriormente datos de imagen en el b\u00fafer de tama\u00f1o insuficiente, causando corrupci\u00f3n de memoria, lo que podr\u00eda conducir a la ejecuci\u00f3n de c\u00f3digo arbitrario o a una denegaci\u00f3n de servicio."}], "lastModified": "2026-10-14T13:10:00.187", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gimp:gimp:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DB5B05ED-02FF-452D-B028-CE07B6204E56", "versionEndIncluding": "3.2.4", "versionStartIncluding": "3.0.0"}, {"criteria": "cpe:2.3:a:gimp:gimp:3.3.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D2ABDCC7-1F05-4E0D-A671-14A01E363F3D"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}