CVE-2026-96543

An out-of-bounds heap write flaw was found in GIMP's PVR image loader. When loading a crafted non-square PVR texture, pvr_decode_twiddle() can write attacker-controlled pixel data beyond the end of a correctly allocated heap buffer because the destination offset is not bounds-checked. A local attacker can exploit this by convincing a user to open a malicious PVR image, potentially causing arbitrary code execution in the file-pvr plug-in process.

This vulnerability is rated as having an Important severity because, although local user interaction is required to open an untrusted file, an attacker can corrupt memory to achieve arbitrary code execution rather than merely causing an application crash. Supported Red Hat Enterprise Linux releases are not affected by this flaw as they do not include the vulnerable image decoding routines.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.