CVE-2026-106067 — Gimp: gimp: heap buffer overflow in hot color filter on oversized image
A heap-based buffer overflow was found in GIMP’s Hot color filter plug-in. For very large images, a pixel buffer is allocated using overflowing 32-bit width * height (and relate…
Published: 2026-10-07 · CVSS: 6.3 · CVSS 3.1
A heap-based buffer overflow was found in GIMP’s Hot color filter plug-in. For very large images, a pixel buffer is allocated using overflowing 32-bit width * height (and related) arithmetic while the filter’s pixel access path uses the true image size, after integer overflow in the allocation size
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7