CVE-2026-106061: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-106061 is a heap buffer over-read vulnerability in GIMP's X cursor (XMC) thumbnail loader, caused by an integer overflow in 32-bit signed arithmetic during pixel buffer size calculation. When GIMP generates a thumbnail for a crafted XMC file, the width * height product can overflow, resulting in an undersized allocation; a subsequent GEGL buffer read then accesses memory beyond the allocated region. The vulnerability was reported by Jim Alves-Foss, disclosed on October 6–7, 2026, and affects GIMP (confirmed on version 3.2.6) as packaged in Red Hat Enterprise Linux. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, GitHub Advisory).

The root cause is a combination of CWE-190 (Integer Overflow) and CWE-125 (Out-of-bounds Read) in the XMC thumbnail loading code located in plug-ins/common/file-xmc.c, specifically within the load_thumbnail() function (approximately lines 1032–1046). The pixel buffer is allocated using a 32-bit signed width * height multiplication; if the product wraps around due to overflow, the allocation is smaller than the actual image data. GEGL subsequently reads using the original, unwrapped dimensions, causing a heap-based out-of-bounds read. The vulnerability is triggered locally when a user opens or previews a specially crafted XMC cursor file, and has been confirmed via AddressSanitizer (ASan) as a heap-buffer-overflow read (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation can result in a denial of service (GIMP crash) or limited disclosure of heap memory contents, potentially including sensitive data such as cryptographic keys, memory addresses, or other process data. In some scenarios, the out-of-bounds read could be leveraged to bypass memory protection mechanisms like ASLR, potentially aiding exploitation of a separate vulnerability for code execution. The scope is limited to the user's GIMP process; no privilege escalation or network-level impact is expected (Red Hat CVE).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date. The vulnerability requires local access and user interaction — an attacker must convince a victim to open or preview a malicious XMC file in GIMP. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Red Hat CVE).

1. Craft a malicious XMC file: Create an X cursor (XMC) file with image dimensions (width × height) chosen so that their product overflows a 32-bit signed integer (e.g., width = 0x8000, height = 0x10000), causing the computed buffer size to wrap to a small value.
2. Deliver the file to the target: Use social engineering, email, or a shared file system to deliver the crafted XMC file to a victim who has GIMP installed.
3. Trigger thumbnail generation: Convince the victim to open the file in GIMP or preview it via a file manager that invokes GIMP's thumbnail loader. GIMP's load_thumbnail() in plug-ins/common/file-xmc.c allocates a pixel buffer using the overflowed (undersized) size.
4. Out-of-bounds read occurs: GEGL reads image data using the original, unwrapped dimensions, accessing heap memory beyond the allocated buffer — resulting in a crash (DoS) or potential heap memory disclosure (Red Hat Bugzilla, Red Hat CVE).

• File System: Presence of unexpected or unsolicited .xmc cursor files in user download directories, temporary folders, or email attachments.
• Process: GIMP process terminating abnormally (segmentation fault or crash) immediately after opening or previewing an XMC file; crash dumps or core files generated by the GIMP process.
• Logs: System logs (e.g., /var/log/messages, journald) recording GIMP segfaults or SIGABRT signals; GNOME/desktop environment logs showing thumbnail generation failures for XMC files.
• Application: GIMP error dialogs or crash reports referencing file-xmc.c or the XMC thumbnail loader component.

Red Hat has acknowledged the vulnerability and a patch is available via Red Hat's security channels (tracked in Bugzilla bug 2546640). Until a patched package is applied, users should avoid opening or previewing XMC cursor files from untrusted sources in GIMP, and should disable thumbnail generation for XMC files if possible. As a general precaution, only open image files from trusted sources (Red Hat CVE, Red Hat Bugzilla).