GIMP CVE-2026-62438

Exploitation requires the victim to open or preview a specially crafted Bohemia Interactive PAA texture file using GIMP's PAA import/decompression code path, so the malicious image must actually be loaded through that plug-in. Limiting factors that reduce real-world risk: the attack vector is local (AV:L) with mandatory user interaction (UI:R) - the file must reach the user and be deliberately opened/previewed - there is no remote or automated trigger, and the outcome is confined to crashing the plug-in process with possible partial heap memory disclosure rather than code execution or system compromise.

This is a moderate-severity, low-priority issue in practice. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H, base 6.1) is internally consistent with the description: exploitation is LOCAL and requires the victim to actively open or preview a malicious file (UI:R), so despite PR:N the attack is not remotely triggerable without social engineering. The primary impact is availability (A:H, plug-in crash/DoS) with only partial confidentiality loss (C:L) from an out-of-bounds read that may disclose adjacent heap memory; integrity is unaffected (I:N) and CWE-190 integer-overflow-to-undersized-allocation does not, per the description, lead to code execution ('terminating the plug-in process unexpectedly'). No EPSS score, KEV listing, or POC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. No signals conflict; rather, the signals converge on a low-urgency file-parsing bug. One noteworthy metadata caveat: the CPE list and tags attribute this to Red Hat Enterprise Linux / Red Hat, but the actual vulnerable software is GIMP (a GNOME project), which Red Hat merely distributes - verify affected-version scope against the GNOME GIMP advisory rather than treating this as an RHEL-core flaw.

An attacker crafts a malicious Bohemia Interactive PAA texture file with dimension values engineered to trigger an integer overflow and emails or hosts it where a GIMP user will download it. When the victim opens or previews the file, GIMP's PAA decompression allocates an undersized buffer and then reads past its boundary, crashing the plug-in (DoS) and potentially exposing adjacent heap memory contents. No public exploit code was identified in the provided data, and the local attack vector with required user interaction (AV:L/UI:R) makes this dependent on successful social engineering.