CVE-2026-82330

MediumCVSS 6.1/10Last modified Nov 6, 2026

Description

A flaw was found in the file-pvr plugin in GIMP. When processing a specially crafted PVR image file, the VQ (compressed) decoder does not properly perform memory bounds checking. This missing validation results in a heap out-of-bounds read. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of heap memory contents.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
GNOME	GIMP	>= 3.2.0, < *
Red Hat	Red Hat Enterprise Linux 6	—
Red Hat	Red Hat Enterprise Linux 7	—
Red Hat	Red Hat Enterprise Linux 8	—
Red Hat	Red Hat Enterprise Linux 9	—

References

https://access.redhat.com/security/cve/CVE-2026-82330Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2525615Issue Tracking, Vendor Advisory
https://gitlab.gnome.org/GNOME/gimp/-/work_items/16586Issue Tracking, Vendor Advisory
https://gitlab.gnome.org/GNOME/gimp/-/work_items/16586Issue Tracking, Vendor Advisory

Timeline

Published: Aug 28, 2026
Last modified: Nov 6, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-823319.8Improper link resolution before file access ('link following') vulnerability in the `tar` source plugin of Apache BuildStream running on Pyt CVE-2026-823325.7An improper authentication vulnerability in WatchGuard Fireware OS's AuthPoint multi-factor authentication process allows a local, unauthent CVE-2026-823337.5multer is a middleware for handling multipart/form-data in Node.js. A small multipart request with two specially crafted text field names ca CVE-2026-823349.1IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based out-of-bounds read in the TDS7 LOGIN7 protocol parser. A remote CVE-2026-823359.8IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based buffer overflow in the MongoDB protocol parser. A remote attacke CVE-2026-823377.3Apache Airflow rebuilt deadline alert fields through generic deserialization, which imports and instantiates the class named in the serializ CVE-2026-82348.8A security vulnerability has been detected in EFM ipTIME A8004T 14.18.2. This vulnerability affects the function formWifiBasicSet of the fil CVE-2026-823409.8IBM Guardium Data Protection 12.2 is vulnerable to unauthenticated insecure deserialization and attacker-controlled reflective method dispat CVE-2026-823436.1A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image file, the plugin does not properly validate t CVE-2026-823449.8IBM Guardium Data Protection 12.0, 12.1 is vulnerable to a heap-based buffer overflow in the S-TAP TrafficTap TDS login reassembly functiona CVE-2026-823467.0A potential security vulnerability has been identified in the HP ImageDiags for versions prior to 5.0.0.36. The vulnerability could potentia CVE-2026-823487.7Authorization Bypass Through User-Controlled Key in Apache Roller 6.1.5 allows an authenticated user with authoring rights on one weblog to