CVE-2026-78465

CVE-2026-78465 is an integer overflow (CWE-190) in GIMP's file-pcx plugin, limited to 32-bit builds of the application. When a user opens a crafted PCX image that declares 4 color planes with sufficiently large dimensions, the plugin's allocation-size calculation exceeds the 32-bit integer limit, producing an undersized heap buffer that is then overflowed as image data is written into it. Successful exploitation causes memory corruption that can lead to arbitrary code execution in the context of the GIMP process, or at minimum a crash/denial of service. Only users running 32-bit GIMP builds are affected, and because the CVSS vector is local (AV:L) with user interaction required (UI:R), an attacker needs the victim to open a malicious PCX file. Exploitation has not been reported in the wild; one public proof-of-concept/issue reference exists on the GNOME GitLab tracker, EPSS is a low 0.2%, and the issue is not in CISA KEV.

What to do: Users of 32-bit GIMP builds should avoid opening untrusted PCX files until a patched release is available, and should watch the GNOME/GIMP tracker (issue 16578) and Red Hat/vendor advisories for the fix; 64-bit builds are not affected, so switching to a 64-bit build where the OS supports it fully mitigates the flaw. Admins should inventory which endpoints run 32-bit GIMP builds and prioritize those for remediation.