Executive brief
GIMP is a widely-used image editing application. The file-pvr plugin, which handles PVR image files, contains a memory safety vulnerability in its VQ (vector quantization) decompression code. When a user opens a specially crafted PVR file, the application may crash or leak sensitive data from memory, disrupting work and potentially exposing confidential information.
Technical details
A heap out-of-bounds read vulnerability exists in the VQ decoder component of GIMP's file-pvr plugin. The vulnerability stems from insufficient memory bounds checking when processing PVR image files with VQ compression. An attacker can craft a malicious PVR file that triggers the out-of-bounds read when opened in GIMP. Exploitation requires user interaction (opening the file) and is reachable via local or network file sources. The impact includes denial of service via application crash and limited information disclosure through heap memory leakage. The vulnerability has not been observed exploited in the wild, and patch status is to be confirmed.
Affected products
- GIMP GIMP <UNKNOWN>
Timeline
- 2026-08-28: disclosed