CVE-2026-106061 Gimp: gimp: heap buffer over-read in x cursor (xmc) thumbnail loader on crafted file
An attacker can cause a crash or memory corruption in GIMP by providing a crafted X cursor file that triggers an integer overflow in thumbnail generation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-106061?
CVE-2026-106061 is a medium-severity vulnerability in Red Hat Enterprise Linux 10, published on 7 Oct 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A flaw was found in GIMP’s X cursor (XMC) thumbnail loader. When GIMP generates a thumbnail for a crafted XMC file, it allocates a pixel buffer using a width * height size computed in 32-bit signed arithmetic. If that product overflows, the allocation is smaller than the true image extent. A subsequent GEGL buffer read uses the unwrapped dimensions and performs an out-of-bounds read on the heap, after integer overflow in the size calculation. This can crash GIMP or corrupt process memory.
Weakness: CWE-125
Which versions are affected by CVE-2026-106061?
How do I fix CVE-2026-106061?
Apply the vendor's patch.
Is CVE-2026-106061 being exploited?
There is no known exploitation of CVE-2026-106061 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-106061, GHSA-p76v-2jpq-7gvc, UBUNTU-CVE-2026-106061.