CVE-2026-106061

A flaw was found in GIMP’s X cursor (XMC) thumbnail loader. When GIMP generates a thumbnail for a crafted XMC file, it allocates a pixel buffer using a width * height size computed in 32-bit signed arithmetic. If that product overflows, the allocation is smaller than the true image extent. A subsequent GEGL buffer read uses the unwrapped dimensions and performs an out-of-bounds read on the heap, after integer overflow in the size calculation. This can crash GIMP or corrupt process memory.

An out-of-bounds read flaw was found in GIMP in the XMC thumbnail loading code. A local attacker could provide a specially crafted X cursor file that, when opened or previewed by the victim, triggers a heap-based buffer over-read. This may result in denial of service or limited disclosure of heap memory. The attacker must convince the user to open or preview the malicious file.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate only open X cursor and other image files from trusted sources; do not preview untrusted files in GIMP.