CVE-2026-42170
published 2026-08-08CVE-2026-42170: A heap-based buffer overflow vulnerability exists in the GIMP DDS (DirectDraw Surface) file parser. When a crafted DDS file declares a D3D9 pixel format but…
PriorityP340high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
0.19%
8.2th percentile
A heap-based buffer overflow vulnerability exists in the GIMP DDS (DirectDraw Surface) file parser. When a crafted DDS file declares a D3D9 pixel format but sets a lower bits-per-pixel (bpp) value in the header, the loader allocates an undersized heap buffer. Subsequent pixel data consumption at the real format's stride causes a write past the heap buffer boundary, leading to heap metadata corruption and potential code execution.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A heap-based buffer overflow vulnerability exists in the GIMP DDS (DirectDraw Surface) file parser.
ghsa_unreviewed·2026-08-08
CVE-2026-42170 [HIGH] CWE-131 A heap-based buffer overflow vulnerability exists in the GIMP DDS (DirectDraw Surface) file parser.
A heap-based buffer overflow vulnerability exists in the GIMP DDS (DirectDraw Surface) file parser. When a crafted DDS file declares a D3D9 pixel format but sets a lower bits-per-pixel (bpp) value in the header, the loader allocates an undersized heap buffer. Subsequent pixel data consumption at the real format's stride causes a write past the heap buffer boundary, leading to heap metadata corruption and potential code execution.
VulDB
GIMP DDS ddsread.c load_layer buffer overflow
vuldb·2026-08-04
CVE-2026-42170 [CRITICAL] GIMP DDS ddsread.c load_layer buffer overflow
A vulnerability described as critical has been identified in GIMP. This vulnerability affects the function load_layer of the file ddsread.c of the component DDS. The manipulation results in buffer overflow.
This vulnerability is known as CVE-2026-42170. It is possible to launch the attack remotely. No exploit is available.
Red Hat
gimp: GIMP DDS plug-in heap-based buffer overflow via BPP mismatch in load_layer() (ddsread.c)
vendor_redhat·2026-08-04·CVSS 7.8
CVE-2026-42170 [HIGH] CWE-131 gimp: GIMP DDS plug-in heap-based buffer overflow via BPP mismatch in load_layer() (ddsread.c)
gimp: GIMP DDS plug-in heap-based buffer overflow via BPP mismatch in load_layer() (ddsread.c)
A heap-based buffer overflow vulnerability exists in the GIMP DDS (DirectDraw Surface) file parser. When a crafted DDS file declares a D3D9 pixel format but sets a lower bits-per-pixel (bpp) value in the header, the loader allocates an undersized heap buffer. Subsequent pixel data consumption at the real format's stride causes a write past the heap buffer boundary, leading to heap metadata corruption and potential code execution.
Statement: This heap-based buffer overflow vulnerability in the GIMP DDS plug-in could lead to heap metadata corruption and potential code execution. The flaw is triggered when a user opens a specially crafted DDS image file. Red Hat Enterprise Linux systems with GIMP
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-106062 gimp: GIMP: heap buffer overflow in DDS loader on crafted DirectDraw Surface file
bugzilla·2026-10-06·CVSS 7.8
CVE-2026-106062 [HIGH] CVE-2026-106062 gimp: GIMP: heap buffer overflow in DDS loader on crafted DirectDraw Surface file
CVE-2026-106062 gimp: GIMP: heap buffer overflow in DDS loader on crafted DirectDraw Surface file
Same upstream issue, Finding 2. plug-ins/common/ddsread.c, read_dds() / load_layer() (~428–1313): pitch/buffer sizing with wrapped width * height (and related fields); GEGL writes past heap buffer. ASan-confirmed heap-buffer-overflow write. Vector: load crafted DDS file. Survives prior DDS fix CVE-2026-42170 (commit 7dff816) per reporter. CVSS tentative: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (7.8).
Bugzilla
CVE-2026-106062 gimp: GIMP: heap buffer overflow in DDS loader on crafted DirectDraw Surface file [fedora-all]
bugzilla·2026-10-06·CVSS 7.8
CVE-2026-106062 [HIGH] CVE-2026-106062 gimp: GIMP: heap buffer overflow in DDS loader on crafted DirectDraw Surface file [fedora-all]
CVE-2026-106062 gimp: GIMP: heap buffer overflow in DDS loader on crafted DirectDraw Surface file [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Same upstream issue, Finding 2. plug-ins/common/ddsread.c, read_dds() / load_layer() (~428–1313): pitch/buffer sizing with wrapped width * height (and related fields); GEGL writes past heap buffer. ASan-confirmed heap-buffer-overflow write. Vector: load crafted DDS file. Survives prior DDS fix CVE-2026-42170 (commit 7dff816) per reporter. CVSS tentative: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (7.8).
Bugzilla
CVE-2026-42170 gimp: GIMP DDS plug-in heap-based buffer overflow via BPP mismatch in load_layer() (ddsread.c)
bugzilla·2026-04-24
CVE-2026-42170 [HIGH] CVE-2026-42170 gimp: GIMP DDS plug-in heap-based buffer overflow via BPP mismatch in load_layer() (ddsread.c)
CVE-2026-42170 gimp: GIMP DDS plug-in heap-based buffer overflow via BPP mismatch in load_layer() (ddsread.c)
A heap-based buffer overflow vulnerability exists in the GIMP DDS (DirectDraw Surface) file parser. When a crafted DDS file declares a D3D9 pixel format but sets a lower bits-per-pixel (bpp) value in the header, the loader allocates an undersized heap buffer. Subsequent pixel data consumption at the real format's stride causes a write past the heap buffer boundary, leading to heap metadata corruption and potential code execution.
2026-08-08
Published