UBUNTU-CVE-2026-106062

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2026-106062

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-106062.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-106062

Upstream

CVE-2026-106062

Published

2026-10-06T21:17:00Z

Modified

2026-10-17T12:58:00Z

Severity

7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

A heap-based buffer overflow was found in GIMP’s DirectDraw Surface (DDS) loader. When loading a crafted DDS image, buffer sizes derived from width, height, and pitch can be computed using 32-bit arithmetic that overflows. The allocated buffer is too small for the amount of pixel data written through GEGL, following integer overflow in size calculations. This may allow heap corruption and, in the worst case, arbitrary code execution in the context of the GIMP process.

References

Affected packages

Ubuntu:26.04:LTS

gimp

Package

Name: gimp
Purl: pkg:deb/ubuntu/gimp?arch=source&distro=resolute

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.0.4-6.1

3.0.4-6.2

3.0.6-1

3.2.0~RC2-2

3.2.0~RC2-3

3.2.0~RC2-3.1

3.2.0~RC2-3.2

3.2.0~RC2-3.3

3.2.0~RC3-1

3.2.0-1

3.2.2-1

3.2.2-1ubuntu0.26.04.1

Ecosystem specific

{
    "binaries":  [
        {
            "binary_name":  "gimp",
            "binary_version":  "3.2.2-1ubuntu0.26.04.1"
        },
        {
            "binary_name":  "gimp-data",
            "binary_version":  "3.2.2-1ubuntu0.26.04.1"
        },
        {
            "binary_name":  "gir1.2-gimp-3.0",
            "binary_version":  "3.2.2-1ubuntu0.26.04.1"
        },
        {
            "binary_name":  "libgimp-3.0-0",
            "binary_version":  "3.2.2-1ubuntu0.26.04.1"
        },
        {
            "binary_name":  "libgimp-3.0-bin",
            "binary_version":  "3.2.2-1ubuntu0.26.04.1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-106062.json"

Ubuntu:26.10

gimp

Package

Name: gimp
Purl: pkg:deb/ubuntu/gimp?arch=source&distro=stonking

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.2.2-1

3.2.4-1

3.2.4-2

3.2.4-3

3.2.6-1

Ecosystem specific

{
    "binaries":  [
        {
            "binary_name":  "gimp",
            "binary_version":  "3.2.6-1"
        },
        {
            "binary_name":  "gimp-data",
            "binary_version":  "3.2.6-1"
        },
        {
            "binary_name":  "gir1.2-gimp-3.0",
            "binary_version":  "3.2.6-1"
        },
        {
            "binary_name":  "libgimp-3.0-0",
            "binary_version":  "3.2.6-1"
        },
        {
            "binary_name":  "libgimp-3.0-bin",
            "binary_version":  "3.2.6-1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-106062.json"

Ubuntu:Pro:16.04:LTS

gimp

Package

Name: gimp
Purl: pkg:deb/ubuntu/gimp?arch=source&distro=esm-apps%2Fxenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.8.14-1ubuntu2

2.8.14-1.2ubuntu1

2.8.16-1ubuntu1

2.8.16-1ubuntu1.1

2.8.16-1ubuntu1.1+esm1

2.8.16-1ubuntu1.1+esm2

2.8.16-1ubuntu1.1+esm3

Ecosystem specific

{
    "binaries":  [
        {
            "binary_name":  "gimp",
            "binary_version":  "2.8.16-1ubuntu1.1+esm3"
        },
        {
            "binary_name":  "gimp-data",
            "binary_version":  "2.8.16-1ubuntu1.1+esm3"
        },
        {
            "binary_name":  "libgimp2.0",
            "binary_version":  "2.8.16-1ubuntu1.1+esm3"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-106062.json"

Ubuntu:Pro:18.04:LTS

gimp

Package

Name: gimp
Purl: pkg:deb/ubuntu/gimp?arch=source&distro=esm-apps%2Fbionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.8.20-1

2.8.20-1.1

2.8.20-2

2.8.22-1

2.8.22-1ubuntu0.1~esm1

2.8.22-1ubuntu0.1~esm2

2.8.22-1ubuntu0.1~esm3

Ecosystem specific

{
    "binaries":  [
        {
            "binary_name":  "gimp",
            "binary_version":  "2.8.22-1ubuntu0.1~esm3"
        },
        {
            "binary_name":  "gimp-data",
            "binary_version":  "2.8.22-1ubuntu0.1~esm3"
        },
        {
            "binary_name":  "libgimp2.0",
            "binary_version":  "2.8.22-1ubuntu0.1~esm3"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-106062.json"

Ubuntu:Pro:20.04:LTS

gimp

Package

Name: gimp
Purl: pkg:deb/ubuntu/gimp?arch=source&distro=esm-apps%2Ffocal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.10.8-2

2.10.14-2

2.10.14-2build1

2.10.14-2ubuntu1

2.10.14-3

2.10.18-1

2.10.18-1ubuntu0.1

2.10.18-1ubuntu0.1+esm1

2.10.18-1ubuntu0.1+esm2

2.10.18-1ubuntu0.1+esm3

Ecosystem specific

{
    "binaries":  [
        {
            "binary_name":  "gimp",
            "binary_version":  "2.10.18-1ubuntu0.1+esm3"
        },
        {
            "binary_name":  "gimp-data",
            "binary_version":  "2.10.18-1ubuntu0.1+esm3"
        },
        {
            "binary_name":  "libgimp2.0",
            "binary_version":  "2.10.18-1ubuntu0.1+esm3"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-106062.json"

Ubuntu:Pro:22.04:LTS

gimp

Package

Name: gimp
Purl: pkg:deb/ubuntu/gimp?arch=source&distro=esm-apps%2Fjammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.10.24-2

2.10.28-1

2.10.30-1

2.10.30-1build1

2.10.30-1ubuntu0.1

2.10.30-1ubuntu0.1+esm1

2.10.30-1ubuntu0.1+esm2

2.10.30-1ubuntu0.1+esm3

Ecosystem specific

{
    "binaries":  [
        {
            "binary_name":  "gimp",
            "binary_version":  "2.10.30-1ubuntu0.1+esm3"
        },
        {
            "binary_name":  "gimp-data",
            "binary_version":  "2.10.30-1ubuntu0.1+esm3"
        },
        {
            "binary_name":  "libgimp2.0",
            "binary_version":  "2.10.30-1ubuntu0.1+esm3"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-106062.json"

Ubuntu:Pro:24.04:LTS

gimp

Package

Name: gimp
Purl: pkg:deb/ubuntu/gimp?arch=source&distro=esm-apps%2Fnoble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.10.34-1

2.10.36-1

2.10.36-2

2.10.36-3build2

2.10.36-3build3

2.10.36-3ubuntu0.24.04.1

2.10.36-3ubuntu0.24.04.1+esm1

2.10.36-3ubuntu0.24.04.1+esm2

2.10.36-3ubuntu0.24.04.1+esm3

Ecosystem specific

{
    "binaries":  [
        {
            "binary_name":  "gimp",
            "binary_version":  "2.10.36-3ubuntu0.24.04.1+esm3"
        },
        {
            "binary_name":  "gimp-data",
            "binary_version":  "2.10.36-3ubuntu0.24.04.1+esm3"
        },
        {
            "binary_name":  "libgimp2.0t64",
            "binary_version":  "2.10.36-3ubuntu0.24.04.1+esm3"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-106062.json"