CVE-2026-106063

A heap-based buffer overflow was found in GIMP’s DICOM export plug-in. When exporting an image with extremely large width and height, the export path allocates a buffer using a 32-bit width * height (and bytes-per-pixel) product that can overflow. GEGL then writes the full uncompressed extent into the undersized buffer, after integer overflow in the allocation size

A heap-based buffer overflow was found in GIMP when exporting images to the DICOM format. If a user exports an image with dimensions large enough to cause integer overflow in buffer size calculations, GIMP may write past the end of a heap-allocated buffer. This could crash GIMP or corrupt memory. Exploitation requires the user to export an oversized image; opening a small malicious file alone is insufficient.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this avoid exporting untrusted or unnecessarily huge images to DICOM; cap image dimensions in workflows that process third-party content. Use checked multiplication and maximum dimension limits in custom automation that drives GIMP export.