CVE-2026-106066

A heap-based buffer overflow was found in GIMP’s raw data export plug-in. When exporting very large images, g_malloc() sizing based on overflowing width * height * bytes-per-pixel can allocate far less memory than GEGL reads or writes during export, following integer overflow

A heap-based buffer overflow was found in GIMP when exporting raw image data. Exporting an image whose dimensions cause integer wrap in buffer size calculations can lead to a heap-based out-of-bounds write and application crash or memory corruption. The user must export an oversized image to reach the vulnerable path.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Avoid raw export of untrusted or abnormally large images; validate dimensions before automated export.