CVE-2026-82330

Published: Aug 28, 2026Modified: Aug 31, 2026

6.1

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

Exploitability: 1.8 / Impact: 4.2

Source: secalert@redhat.com (Secondary)

Description

A flaw was found in the file-pvr plugin in GIMP. When processing a specially crafted PVR image file, the VQ (compressed) decoder does not properly perform memory bounds checking. This missing validation results in a heap out-of-bounds read. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of heap memory contents.

Affected (5)

Products: Gimp: Gimp · Redhat: Enterprise Linux

1 product

1 product

Enterprise Linux

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Gimp Gimp	Up to 3.3.1

Configuration B

4 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux	Version 6.0
Redhat Enterprise Linux	Version 7.0
Redhat Enterprise Linux	Version 8.0
Redhat Enterprise Linux	Version 9.0

Related CWEs

Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

References (4)

https://access.redhat.com/security/cve/CVE-2026-82330

Source: secalert@redhat.com

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2525615

Source: secalert@redhat.com

Issue TrackingVendor Advisory

https://gitlab.gnome.org/GNOME/gimp/-/work_items/16586

Source: secalert@redhat.com

Issue TrackingVendor Advisory

https://gitlab.gnome.org/GNOME/gimp/-/work_items/16586

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Issue TrackingVendor Advisory

Timeline

No history available yet.