Source: gimp Version: 3.2.4-3 Severity: important Tags: security upstream Forwarded: https://gitlab.gnome.org/GNOME/gimp/-/work_items/16494 X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerability was published for gimp. CVE-2026-66757[0]: | A flaw was found in the file-sgi plugin in GIMP. When processing an | RLE-compressed SGI image, the plugin allocates memory for a row | table. The image header dimensions (ysize and zsize) are read as | 16-bit unsigned integers. If a crafted file sets both dimensions to | their maximum value (65535), the multiplication ysize * zsize | overflows the standard 32-bit int boundary before being passed to | calloc. This integer overflow issue results in undefined behavior, | aborting the plugin and causing a denial of service. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-66757 https://www.cve.org/CVERecord?id=CVE-2026-66757 [1] https://gitlab.gnome.org/GNOME/gimp/-/work_items/16494 [2] https://gitlab.gnome.org/GNOME/gimp/-/merge_requests/2884 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
