CVE-2026-58385

A flaw was found in GIMP's PVR decoder. A heap-based out-of-bounds write occurs in pvr_decode_compressed() because the Y-axis loop uses width / 2 instead of height / 2, allowing crafted non-square textures to write past the destination buffer. This could lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.

A flaw was found in GIMP's PVR decoder. An incorrect loop bound in pvr_decode_compressed() can cause heap memory corruption when a user opens a specially crafted non-square compressed PVR texture. Successful exploitation requires user interaction to open a malicious file.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.