CVE-2026-82330: 
NixOS vulnerability analysis and mitigation

CVE-2026-82330 is a heap out-of-bounds read vulnerability in the file-pvr plugin of GIMP, specifically in the VQ (compressed) decoder, which fails to perform proper memory bounds checking when processing specially crafted PVR image files. The flaw affects GIMP versions 3.2.0 and newer (up to and including 3.3.1), as well as Red Hat Enterprise Linux 6, 7, 8, and 9 distributions shipping affected GIMP packages. It was reported by Zhixi "Jace" Sun, disclosed on August 28, 2026, and a patch was made available the same day. The vulnerability carries a CVSS v3.1 base score of 6.1 (Medium) (Red Hat Advisory, GitHub Advisory).

The root cause is classified as CWE-125 (Out-of-bounds Read): the VQ (compressed) decoder in GIMP's file-pvr plugin does not validate memory boundaries when parsing PVR image data, allowing reads beyond the intended buffer. Exploitation requires local access and user interaction — an attacker must convince a victim to open a maliciously crafted PVR image file in GIMP. The out-of-bounds read can trigger a segmentation fault (application crash) or expose limited heap memory contents, potentially including sensitive data such as memory addresses useful for bypassing ASLR. The vulnerability is tracked in the GNOME GitLab issue tracker and Red Hat Bugzilla (Red Hat Advisory, Red Hat Bugzilla, GNOME GitLab).

Successful exploitation can cause GIMP to crash, resulting in a denial of service for the affected user. Additionally, limited heap memory contents may be disclosed, which could theoretically expose sensitive in-memory data or memory layout information (e.g., addresses useful for ASLR bypass). The impact is confined to the local user's session; there is no integrity impact and no evidence of remote code execution potential from this vulnerability alone (Red Hat Advisory, GitHub Advisory).

No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation at this time. The NVD SSVC assessment notes exploitation status as "poc" but no confirmed PoC has been published. The EPSS score is approximately 0.119–0.186%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires social engineering to convince a user to open a malicious PVR file locally, reducing the overall risk (Red Hat Advisory, GitHub Advisory).

1. Craft malicious PVR file: Create a specially crafted PVR image file with malformed VQ (compressed) data that causes the decoder to read beyond the allocated heap buffer when parsed by GIMP's file-pvr plugin.
2. Social engineering: Deliver the malicious PVR file to a target user via email attachment, file sharing, or a malicious website, and convince them to open it with GIMP (e.g., by disguising it as a legitimate image).
3. Trigger the vulnerability: When the user opens the file in GIMP, the file-pvr plugin's VQ decoder processes the image without proper bounds checking, triggering the heap out-of-bounds read.
4. Achieve objective: Depending on heap layout, the result is either an application crash (denial of service) or limited disclosure of heap memory contents, which could be used to leak memory addresses for further exploitation (Red Hat Advisory, Red Hat Bugzilla).

• Process: GIMP process terminating unexpectedly (segmentation fault or crash) immediately after opening a PVR image file.
• Logs: System crash reports or core dumps referencing the GIMP file-pvr plugin or VQ decoder; entries in /var/log/messages or application logs showing GIMP segfault.
• File System: Presence of unexpected or unsolicited .pvr image files in user download directories or temporary folders, particularly from external or untrusted sources.
• Network: Unusual inbound delivery of .pvr files via email or web downloads to workstations running GIMP (Red Hat Advisory).

GIMP version 3.2.6 was released on September 10, 2026, addressing this vulnerability; users should upgrade to this or a later version (GIMP Release). As an immediate workaround, Red Hat recommends not opening PVR files from untrusted sources with GIMP (Red Hat Advisory). Organizations can also restrict or disable PVR image file support in GIMP if it is not required for business operations, and should educate users to avoid opening image files from unknown or untrusted origins.

Red Hat rated this vulnerability as Moderate severity, noting that exploitation requires convincing a user to process a specially crafted PVR image, which reduces the likelihood of exploitation (Red Hat Advisory). Red Hat acknowledged the reporter, Zhixi "Jace" Sun, for responsible disclosure. No significant broader media coverage or notable researcher commentary beyond standard vulnerability database entries has been observed.