CVE-2026-78465: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-78465 is a heap-based buffer overflow vulnerability in the file-pcx plugin of GIMP, affecting 32-bit builds only. When processing a crafted PCX image file with 4 color planes and sufficiently large dimensions, an integer overflow in the memory allocation size calculation results in an undersized heap buffer, which is subsequently overflowed when image data is written into it. This can lead to memory corruption, arbitrary code execution, or denial of service. The vulnerability was disclosed on August 24, 2026, and was reported by Zhixi "Jace" Sun. It carries a CVSS v3.1 base score of 7.0 (High) (Red Hat Advisory, Github Advisory).

The root cause is an integer overflow (CWE-190) in the file-pcx plugin's memory allocation logic. When a PCX file specifies 4 color planes alongside large image dimensions, the product of these values exceeds the 32-bit integer maximum, wrapping around to a small value and causing malloc() (or equivalent) to allocate an undersized heap buffer. When the plugin subsequently writes the full image data into this buffer, an out-of-bounds write (CWE-787) occurs, corrupting adjacent heap memory. Exploitation requires a local attack vector with user interaction — the victim must open a specially crafted PCX file in a 32-bit GIMP build. The GNOME project tracks this issue at GitLab work item #16578 (Red Hat Advisory, Red Hat Bugzilla).

Successful exploitation can result in arbitrary code execution with the privileges of the GIMP process, or a denial of service via application crash. Because the attack is local and requires user interaction (opening a malicious PCX file), the scope is limited to the affected user's session. Red Hat notes that default RHEL security mitigations — including SELinux, ASLR, and NX stack protection — significantly increase the difficulty of achieving arbitrary code execution in practice (Red Hat Advisory).

As of disclosure on August 24, 2026, there is no confirmed public proof-of-concept exploit or evidence of in-the-wild exploitation. The NVD SSVC assessment classifies exploitation status as "poc" but notes the vulnerability is not automatable and requires user interaction. The EPSS score is 0.0, reflecting a currently low probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is further constrained to 32-bit GIMP builds, limiting the attack surface (Red Hat Advisory, Github Advisory).

1. Craft a malicious PCX file: Create a PCX image file that specifies 4 color planes (planes=4) and sets image dimensions large enough that width × height × planes exceeds the 32-bit integer limit (e.g., dimensions near 2^30 pixels), causing the allocation size to wrap around to a small value.
2. Deliver the file to the target: Use social engineering, phishing, or a malicious download to convince a user running a 32-bit GIMP build to open the crafted PCX file.
3. Trigger the integer overflow: When GIMP's file-pcx plugin processes the file, it calculates the buffer size using the overflowed value, resulting in a heap allocation far smaller than needed.
4. Heap buffer overflow: The plugin writes the full image data into the undersized buffer, overwriting adjacent heap memory with attacker-controlled content.
5. Achieve code execution or crash: Depending on heap layout and platform mitigations, the memory corruption may be leveraged to redirect execution flow (e.g., overwriting function pointers or heap metadata) to execute arbitrary code, or may simply crash the application (Red Hat Advisory, Red Hat Bugzilla).

• File System: Presence of unexpected or suspicious .pcx files in user download directories, email attachments, or shared folders; unusual files written to disk by the GIMP process after opening a PCX file.
• Process: GIMP process (32-bit) crashing unexpectedly or spawning unexpected child processes (e.g., shells or network utilities) after opening a PCX file; core dump files generated by GIMP in /var/crash/ or the user's home directory.
• Logs: Application crash logs or SELinux AVC denial messages related to the GIMP process attempting unauthorized actions after processing a PCX file; entries in /var/log/audit/audit.log showing GIMP attempting to execute code or access unexpected resources.

The primary workaround recommended by Red Hat is to avoid opening PCX files from untrusted sources in GIMP. Users should migrate to 64-bit GIMP builds where possible, as the vulnerability exclusively affects 32-bit builds. Running GIMP in a sandboxed environment or with reduced privileges can limit the impact of exploitation. A patch has been published (tracked via GitHub Advisory GHSA-944m-78f8-q7cr); users should update GIMP to the latest patched version when available for their distribution (Red Hat Advisory, Github Advisory).

Red Hat, as the CVE Naming Authority (CNA) for this vulnerability, has rated it as "Important" severity and acknowledged that default RHEL security features (SELinux, ASLR, NX) reduce the practical exploitability. Red Hat credited Zhixi "Jace" Sun for responsibly reporting the issue. No significant broader community or social media discussion has been identified at this time (Red Hat Advisory).