CVE-2026-78465

A flaw was found in the file-pcx plugin in GIMP, affecting 32-bit builds only. When processing a PCX image file, the plugin calculates memory allocation sizes based on the image dimensions and the number of color planes. If a crafted file sets the number of planes to 4 alongside sufficiently large dimensions, the calculation exceeds the 32-bit integer limit and overflows, resulting in an undersized heap-based buffer allocation. This integer overflow issue results in a heap-based buffer overflow when the plugin subsequently writes image data into the undersized buffer, causing memory corruption, potentially leading to arbitrary code execution or a denial of service.

• CWE-190

• https://access.redhat.com/security/cve/CVE-2026-78465Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2522057Issue Tracking, Vendor Advisory
• https://gitlab.gnome.org/GNOME/gimp/-/work_items/16578Issue Tracking, Vendor Advisory, Exploit, Mitigation
• https://gitlab.gnome.org/GNOME/gimp/-/work_items/16578Issue Tracking, Vendor Advisory, Exploit, Mitigation

Published

Aug 24, 2026

Last Modified

Oct 14, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-78459Heap-based buffer overflow in Windows Internet Information S…7.8
• CVE-2026-7846A vulnerability has been found in chatchat-space Langchain-C…2.6
• CVE-2026-78461Improper limitation of a pathname to a restricted directory …7.4
• CVE-2026-78462Authorization bypass through user-controlled key in Visual S…8.8
• CVE-2026-78463Improper control of generation of code ('code injection') in…8.8
• CVE-2026-78464Time-of-check time-of-use (toctou) race condition in Windows…7
• CVE-2026-78466Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-78467Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-78468Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-7847A vulnerability was found in chatchat-space Langchain-Chatch…2.6
• CVE-2026-78470The WP Project Manager Pro plugin for WordPress is vulnerabl…6.5
• CVE-2026-78471The Autoptimize plugin for WordPress is vulnerable to Stored…5.4