CVE-2026-106067

A heap-based buffer overflow was found in GIMP’s Hot color filter plug-in. For very large images, a pixel buffer is allocated using overflowing 32-bit width * height (and related) arithmetic while the filter’s pixel access path uses the true image size, after integer overflow in the allocation size

A heap-based buffer overflow was found in GIMP in the Hot color filter. Applying the filter to an image with extremely large dimensions can cause a heap-based out-of-bounds write because the allocated buffer is smaller than the data the filter processes. The user must run the filter on an oversized image; opening a small malicious file alone does not trigger this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not run the Hot filter (or similar heavy filters) on untrusted images with extreme dimensions; limit canvas size in untrusted workflows