CVE-2026-106063: GIMP DICOM Buffer Overflow Vulnerability

CVE-2026-106063 Overview

CVE-2026-106063 is a heap-based buffer overflow in the GNU Image Manipulation Program (GIMP) DICOM export plug-in. The flaw occurs when a user exports an image with extremely large width and height values. The export path calculates the buffer size using a 32-bit multiplication of width * height * bytes-per-pixel, which can overflow. GEGL then writes the full uncompressed image data into the undersized heap allocation, producing an out-of-bounds write classified under [CWE-787]. The vulnerability requires local access and user interaction to trigger, limiting remote exploitation potential.

Critical Impact
Successful exploitation can corrupt heap memory, crash GIMP, or enable arbitrary code execution in the context of the user running the DICOM export operation.

Affected Products

GNU Image Manipulation Program (GIMP) DICOM export plug-in
GEGL (Generic Graphics Library) buffer handling path
Linux distributions packaging the affected GIMP builds (see Red Hat advisory)

Discovery Timeline

2026-10-06 - CVE-2026-106063 published to the National Vulnerability Database (NVD)
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-106063

Vulnerability Analysis

The vulnerability resides in the DICOM export plug-in shipped with GIMP. During export, the plug-in computes the raw pixel buffer size by multiplying image width, height, and bytes-per-pixel using 32-bit arithmetic. When a crafted image uses extremely large dimensions, this product wraps around and yields a smaller value than the true pixel data size. The plug-in allocates a heap buffer sized by the truncated result. GEGL subsequently serializes the complete uncompressed image extent into that undersized allocation, overwriting adjacent heap metadata and application data. The condition maps to [CWE-119] and [CWE-787], representing an integer overflow that drives an out-of-bounds heap write.

Root Cause

The root cause is unsafe 32-bit size arithmetic in the DICOM export allocation path. The code does not validate the multiplication for overflow before calling the allocator, nor does it use checked arithmetic or 64-bit intermediates. Any image whose width * height * bpp exceeds UINT32_MAX wraps silently.

Attack Vector

Exploitation requires a local user to open a malicious image in GIMP and invoke DICOM export, or to script the export against attacker-supplied dimensions. The attack vector is local and complexity is high because the user must trigger the export action. Confidentiality is not impacted, but integrity and availability of the GIMP process are. Reference the Red Hat CVE-2026-106063 Advisory and Red Hat Bug Report #2546668 for upstream technical details.

No verified public exploit code is available. The vulnerability is described in prose only.

Detection Methods for CVE-2026-106063

Indicators of Compromise

Unexpected GIMP process crashes with SIGSEGV or SIGABRT signatures during or immediately after DICOM export operations.
Core dumps referencing the DICOM plug-in or GEGL buffer write functions.
Presence of DICOM-targeted image files with abnormally large declared width and height header fields in user download or temp directories.

Detection Strategies

Monitor glibc heap corruption diagnostics (for example, malloc(): corrupted messages) emitted to the system journal by the GIMP process.
Enable AddressSanitizer or glibc MALLOC_CHECK_ instrumentation in test environments to catch out-of-bounds writes during image handling.
Flag file-open telemetry on hosts where image editing applications process untrusted DICOM or image samples from external sources.

Monitoring Recommendations

Collect endpoint process-crash telemetry and correlate GIMP terminations with recent file access events.
Audit installed GIMP package versions across workstations and compare against vendor security advisories for patched builds.
Track user-initiated DICOM exports in environments handling medical imaging workflows to establish a baseline for anomalous activity.

How to Mitigate CVE-2026-106063

Immediate Actions Required

Apply the GIMP package update supplied by your Linux distribution once the fixed version is published; monitor the Red Hat CVE-2026-106063 Advisory for availability.
Instruct users to avoid opening or exporting untrusted DICOM or image files, especially those with unusually large pixel dimensions.
Restrict GIMP execution to non-privileged accounts to limit the blast radius of any heap corruption.

Patch Information

At publication time, the Red Hat advisory tracks remediation status for affected packages. Consult the vendor advisory and the upstream GIMP project for the exact fixed version string. The expected code-level fix is to perform the pixel buffer size calculation using 64-bit integers with checked arithmetic and to reject images whose computed size exceeds a safe allocation threshold.

Workarounds

Do not export images to DICOM format in GIMP until the patched package is deployed.
Enforce file-size and dimension validation on image intake pipelines that feed GIMP automation.
Run GIMP inside a sandbox such as Flatpak or Firejail to contain memory corruption outcomes.

bash

# Verify installed GIMP version and check for pending security updates
rpm -q gimp
dnf updateinfo info --cve CVE-2026-106063
dnf upgrade --security gimp