CVE-2026-82330: GIMP PVR Plugin DOS Vulnerability

CVE-2026-82330 Overview

CVE-2026-82330 is a heap out-of-bounds read vulnerability in the file-pvr plugin shipped with GIMP. The flaw resides in the VQ (Vector Quantization) compressed decoder, which fails to perform proper memory bounds checking when parsing PVR image files. An attacker who convinces a user to open a specially crafted PVR file can trigger the condition. Successful exploitation can crash the application, producing a denial of service, or leak a limited amount of adjacent heap memory. The vulnerability is tracked under [CWE-125] (Out-of-bounds Read) and affects GIMP as distributed on Red Hat Enterprise Linux 6, 7, 8, and 9.

Critical Impact
Attackers can crash GIMP or disclose fragments of heap memory by delivering a malicious PVR image to a local user who opens it in the affected application.

Affected Products

GIMP (file-pvr plugin)
Red Hat Enterprise Linux 6, 7, 8, 9
Any Linux distribution shipping the vulnerable GIMP file-pvr decoder

Discovery Timeline

2026-08-28 - CVE-2026-82330 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-82330

Vulnerability Analysis

The defect lives in the PowerVR (PVR) image loader that GIMP uses to import textures encoded with the PVR container format. The file-pvr plugin supports several PVR variants, including VQ-compressed textures that store a codebook followed by index data referencing 2x2 pixel blocks. When decoding VQ-compressed data, the decoder trusts header-derived dimensions and index values without validating them against the actual size of the allocated codebook or pixel buffer. Reading beyond the codebook or image buffer causes the process to access uninitialized or unrelated heap memory. Depending on allocator layout, this either crashes GIMP or returns adjacent heap bytes that can be rendered into the output canvas and observed by the user.

Root Cause

The root cause is missing bounds validation in the VQ decoder path of the file-pvr plugin. The code path computes read offsets from attacker-controlled fields in the PVR header and payload, then dereferences those offsets without confirming they fall inside the allocated buffer. Because the read occurs on the heap, the out-of-bounds access is classified as [CWE-125].

Attack Vector

Exploitation requires local access and user interaction. An attacker crafts a malicious .pvr file with header values or VQ index data that force the decoder to read past buffer boundaries. The victim must open the file in GIMP, either directly or through a file manager preview handler that invokes GIMP. Network attack vectors are not applicable, but the file can be delivered through email attachments, shared storage, or web downloads before being opened locally. Impact is limited to denial of service (application crash) and a bounded information disclosure of heap contents.

No public proof-of-concept exploit or exploitation in the wild has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-82330

Indicators of Compromise

Unexpected GIMP crashes or SIGSEGV entries in system logs shortly after a user opens a .pvr file
Presence of unsolicited or suspicious PVR image files in user download, email attachment, or temp directories
Core dumps referencing the file-pvr plugin binary or the VQ decoding routines

Detection Strategies

Hunt for process crashes where the faulting module is the GIMP file-pvr plugin using OS-level crash telemetry such as systemd-coredump or abrt logs.
Alert on GIMP child processes terminating abnormally within a short window of opening files with a .pvr extension.
Scan file shares and email gateways for PVR files that fail schema validation against the documented PVR header layout.

Monitoring Recommendations

Ingest Linux audit and coredump events into a centralized log platform and correlate GIMP crashes with recent file-open events.
Track the installed GIMP package version across the fleet and flag hosts that remain on unpatched builds after vendor updates land.
Monitor endpoint telemetry for GIMP spawning from unusual parents such as email clients or browser download helpers, which increases the likelihood of malicious file delivery.

How to Mitigate CVE-2026-82330

Immediate Actions Required

Apply vendor-provided GIMP updates once available from the upstream GNOME project or the applicable Linux distribution.
Instruct users to avoid opening PVR image files from untrusted sources until patches are deployed.
Enumerate systems with GIMP installed and prioritize patch rollout on multi-user workstations and shared build hosts.

Patch Information

Refer to the vendor advisories for patch status and package versions: the Red Hat CVE-2026-82330 Advisory, the Red Hat Bug Report #2525615, and the upstream GNOME GIMP Work Item #16586. Apply distribution updates through the standard package manager once the fixed builds are published.

Workarounds

Disable or remove the file-pvr plugin from the GIMP plug-ins directory if PVR support is not required in your environment.
Block inbound .pvr attachments at the email gateway and web proxy where feasible.
Restrict file associations so that PVR files do not automatically launch GIMP from file managers or preview handlers.

bash

# Locate and disable the vulnerable plugin (adjust path for your distribution)
find /usr/lib*/gimp -type f -name 'file-pvr*' -print
sudo chmod a-x /usr/lib64/gimp/2.0/plug-ins/file-pvr/file-pvr