Quick answers
- Is CVE-2026-78465 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-78465 being exploited in the wild.
- How severe is CVE-2026-78465?
- High severity, with a CVSS score of 7, published 24 August 2026.
- Which products and versions are affected?
- GIMP GIMP.
- Is there a fix for CVE-2026-78465?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-78465 attacked?
- It is attacked over the network or with local access, in a software library.
- Am I affected by CVE-2026-78465?
- Check whether you run Gimp. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An integer overflow vulnerability exists in GIMP's file-pcx plugin when calculating heap buffer allocation sizes for 32-bit builds. The plugin multiplies image dimensions by the number of color planes; if a crafted PCX file specifies 4 planes with sufficiently large dimensions, this calculation exceeds the 32-bit integer maximum, resulting in an undersized buffer allocation. When the plugin subsequently writes image data to this buffer, a heap-based buffer overflow occurs, potentially enabling arbitrary code execution or denial of service. The vulnerability requires processing a specially crafted PCX file and affects only 32-bit GIMP builds.
Affected products
- GIMP GIMP
Timeline
- 2026-08-24: disclosed