CVE-2026-106063 MEDIUM

CVE-2026-106063: Gimp: gimp: heap buffer overflow in dicom export on oversized image dimensions

Vendor Red Hat
Product Red Hat Enterprise Linux 10
Weakness CWE-119
Published October 6, 2026
Last update October 8, 2026

CVSS base score

6.3/10
Attack vector Local
Attack complexity High
Privileges required None
User interaction Required
Confidentiality None
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H

What the vulnerability does

01Description

A heap-based buffer overflow was found in GIMP’s DICOM export plug-in. When exporting an image with extremely large width and height, the export path allocates a buffer using a 32-bit width * height (and bytes-per-pixel) product that can overflow. GEGL then writes the full uncompressed extent into the undersized buffer, after integer overflow in the allocation size

Key dates

02Disclosure timeline

October 6, 2026 CVE published
October 8, 2026 Record updated