CVE-2026-42170: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-42170 is a heap-based buffer overflow vulnerability in the GIMP DDS (DirectDraw Surface) file parser plug-in (ddsread.c). When a crafted DDS file declares a D3D9 pixel format but specifies a lower bits-per-pixel (bpp) value in the header, the loader allocates an undersized heap buffer; subsequent pixel data consumption at the real format's stride causes a write past the heap buffer boundary. The CVE was reported on 2026-04-24 and published on 2026-08-04, and is currently in a "Reserved" status. It is rated HIGH severity (Red Hat CVE, Red Hat Bugzilla).

The root cause is an incorrect calculation of buffer size (CWE-131) in the load_layer() function within ddsread.c, the GIMP DDS plug-in. When parsing a crafted DDS file, the code uses the attacker-controlled bpp field from the header to determine heap allocation size, but then reads pixel data at the stride dictated by the actual D3D9 pixel format — which is larger — resulting in an out-of-bounds write (CWE-787) past the heap buffer boundary. Exploitation requires a victim to open a maliciously crafted DDS image file in GIMP. No public proof-of-concept code has been identified at this time (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation leads to heap metadata corruption and potentially arbitrary code execution in the context of the user running GIMP. An attacker who tricks a user into opening a specially crafted DDS file could gain full control of the affected system, enabling data theft, installation of malware, or further lateral movement within the network. Confidentiality, integrity, and availability are all at risk (Red Hat Bugzilla).

The CVE status is currently "Reserved" and no in-the-wild exploitation has been reported. No public exploit code, exploit kits, or threat actor attribution are known at this time. Exploitation requires user interaction — specifically, a victim must open a maliciously crafted DDS file in GIMP. No EPSS score or CISA KEV catalog entry has been identified for this vulnerability (Red Hat CVE, Red Hat Bugzilla).

1. Craft malicious DDS file: Create a DDS file that declares a D3D9 pixel format in its header but sets a deliberately lower bits-per-pixel (bpp) value than the format actually requires, causing a mismatch between the allocated buffer size and the stride used during pixel data consumption.
2. Deliver the file to the target: Use social engineering, phishing, or a malicious download to deliver the crafted .dds file to a victim who uses GIMP (e.g., a graphic designer or game developer).
3. Trigger file parsing: Convince the victim to open the crafted DDS file in GIMP, which invokes the DDS plug-in's load_layer() function in ddsread.c.
4. Trigger heap overflow: The plug-in allocates a heap buffer sized according to the attacker-controlled (undersized) bpp value, then writes pixel data at the real format's larger stride, overflowing the buffer and corrupting adjacent heap metadata.
5. Achieve code execution: Leverage heap metadata corruption to redirect execution flow, potentially achieving arbitrary code execution in the context of the GIMP process (Red Hat Bugzilla).

A patch has been identified and tracked via Red Hat Bugzilla (Bug 2461726), though a specific fixed GIMP version number has not yet been publicly confirmed. Users should update GIMP to the latest available version once a patched release is issued, and avoid opening untrusted or unexpected DDS image files in the interim. Organizations should monitor vendor advisories from the GIMP project and downstream distributors (e.g., Red Hat, Fedora) for patch availability (Red Hat Bugzilla, Red Hat CVE).