CVE-2026-96546: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-96546 is a one-byte out-of-bounds heap read vulnerability in GIMP's uncompressed DDS image loader (file-dds plug-in). When a user opens an uncompressed DDS image, the plug-in performs an unconditional one-byte look-ahead past the end of the pixel buffer after processing the final pixel, which may cause a crash under specific memory layout conditions. The vulnerability affects GIMP (including versions in the main and gimp-3-2 branches, confirmed with AddressSanitizer in GIMP 3.2.6) as packaged by Red Hat. It was disclosed on September 22–23, 2026, with a CVSS v3.1 base score of 2.5 (Low) (Red Hat CVE, Github Advisory).

The root cause is an out-of-bounds read (CWE-125) in GIMP's load_layer() function within the DDS image loader. The bit-reader unconditionally increments the input pointer and fetches the next byte whenever the current byte's bits are exhausted; after processing the final pixel of an uncompressed DDS image, this logic dereferences exactly one byte beyond the allocated pixel buffer. The flaw is triggered by ordinary, well-formed uncompressed DDS files — including files produced by GIMP itself — and requires no malformed or specially crafted input beyond a standard DDS file. Exploitation requires local access and user interaction (opening a DDS file), and a crash only occurs if the byte immediately following the allocation happens to be inaccessible in memory. This issue is distinct from CVE-2026-42170, which concerns a separate pitch-overflow write in the same file (Red Hat Bugzilla, Red Hat CVE).

The primary impact is a potential denial-of-service (crash) of the GIMP application when a user opens an uncompressed DDS image under specific memory conditions. No information disclosure or code execution has been demonstrated; in a normal non-instrumented build, the adjacent byte is read into a local variable and does not influence the decoded image. The scope is limited to the GIMP process itself, with no lateral movement potential or sensitive data exposure identified (Red Hat CVE, Red Hat Bugzilla).

There are no known public proof-of-concept exploits, no evidence of in-the-wild exploitation, and no threat actor attribution associated with this vulnerability. The EPSS score is 0.0, reflecting negligible probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires high attack complexity, local access, and user interaction, making opportunistic exploitation highly unlikely (Github Advisory, Red Hat CVE).

A patch was available at the time of reporting (referenced in the GNOME GitLab work item), though no specific fixed GIMP release version had been formally identified. Red Hat's recommended workaround is to avoid importing uncompressed DDS images from untrusted sources; no application-level mitigation that preserves processing of untrusted DDS files is known. Users should monitor for updated GIMP packages from their distribution vendor and apply them when available (Red Hat CVE, Red Hat Bugzilla).