Integer Overflow Vulnerability in GIMP file-pvr Plug-in

A security vulnerability (CVE-2026-62439) has been identified in the GIMP image manipulation software. The flaw exists within the file-pvr plug-in, which is responsible for parsing PowerVR (.pvr) image files. An integer overflow occurs during the calculation of memory buffer sizes based on the image dimensions provided in the file header. An attacker can exploit this by enticing a victim to open or preview a specially crafted .pvr image file. Successful exploitation leads to a heap-based buffer overflow, which can result in an application crash (Denial of Service) or arbitrary code execution within the context of the user running GIMP. This vulnerability affects GIMP across all supported platforms, including Windows, Linux, and macOS. Users are advised to upgrade to a patched version once available and avoid opening untrusted or unknown .pvr files.

Impact

Successful exploitation of CVE-2026-62439 allows an unauthenticated attacker to achieve code execution or perform a denial of service attack against the GIMP application. This presents a high risk to users who frequently work with external or untrusted graphics files. Organizations should identify systems where GIMP is installed and monitor for the opening of .pvr files from untrusted sources until patches are applied.

Recommendation

• Monitor endpoint file access logs for GIMP (gimp-2.x.exe or gimp-console) opening files with the .pvr extension.
• Disable or remove the file-pvr plug-in if PVR image support is not required for business operations.
• Apply vendor security updates for GIMP as soon as they are made available to address CVE-2026-62439.