CVE-2026-78465

Executive Summary

CVE-2026-78465 is an integer overflow vulnerability in the file-pcx plugin of GIMP, a widely used open-source image manipulation program. The flaw affects 32-bit builds of GIMP and is triggered when processing a crafted PCX image file that sets the number of color planes to 4 and uses sufficiently large image dimensions, causing a heap-based buffer overflow. Successful exploitation can lead to arbitrary code execution or a denial of service, with a CVSS score of 7.0 placing this in the High severity band. The vulnerability is currently unpatched, and no public exploit code or CISA KEV listing exists at the time of this writing.

The attack surface is client-side: a user must open a malicious PCX file, either delivered via email attachment, web download, or embedded in a document viewer that relies on GIMP's file handling. Because the flaw is specific to 32-bit builds, the blast radius is smaller than a typical image-parsing vulnerability, but it is nonetheless critical for affected users because the overflow occurs during parsing of an extremely common file format (PCX, one of the oldest bitmap formats). Given the lack of a patch, enterprise organizations running 32-bit GIMP installations or users on 32-bit operating systems should treat this as an actively exploitable risk and apply compensating controls immediately.

Technical Analysis

The vulnerability resides in the PCX image-loading routine of the file-pcx plugin within GIMP. PCX files contain header structures that specify image metadata, including width, height, and the number of color planes (commonly 1 for grayscale, 3 for RGB, and 4 for RGB plus an alpha or intensity channel). The file-pcx plugin reads these header values and uses them to calculate the contiguous memory region required to store decoded pixel data during the read operation.

The flaw is an integer overflow (CWE-190) in the allocation-size calculation. The calculation multiplies the image width, the image height, and the number of color planes (stored in the file header) to determine the required buffer size. On 32-bit builds, the multiplication is performed using 32-bit signed or unsigned integers. If a crafted file declares 4 color planes and sets the width and height to values whose product exceeds the maximum 32-bit integer value (2,147,483,647), the multiplication wraps around and produces a smaller positive number. Consequently, the plugin invokes a heap-allocation routine (e.g., g_malloc or malloc) with this undersized size, allocating a buffer that is smaller than the actual data that will be written.

The plugin subsequently reads the pixel data from the file and writes it into this undersized buffer in a loop. Because the write path does not re-check the buffer capacity against the actual input size, the read of the file bytes exceeds the allocated region, causing a classic heap-based buffer overflow. The magnitude of the overflow depends on the degree of truncation during the integer wrap. In the worst case, the write can overlap adjacent heap chunk metadata, corrupting the heap free-list or overwriting neighboring objects. This can manifest as a memory-corruption primitive that an attacker may leverage to achieve arbitrary code execution — for example, by overwriting a function pointer stored in a nearby heap object — or be triggered as a crash (denial of service) when the corrupted heap is later used.

Notably, this issue is architecture-specific: on 64-bit builds, the arithmetic operations are performed with 64-bit word sizes, so the same crafted file yields a correct (non-overflowing) allocation size, and the plugin either reads the data successfully or fails gracefully with an out-of-memory error. The vulnerability therefore only manifests when GIMP is compiled for a 32-bit target (x86, ARMv7, etc.).

Insufficient technical detail is available in the NVD description regarding the exact function names within the file-pcx plugin, the specific allocation routine invoked, or the precise loop structure. However, the class of vulnerability is well understood: an arithmetic overflow leading to an undersized allocation followed by a write past the buffer boundary. Attackers with the ability to craft PCX files would be able to trigger this by generating a file with the appropriate header values (width, height, planes=4) designed to wrap the multiplication. Public proof-of-concept code is not available, and no exploit-in-the-wild, so exploitation mechanics beyond the class level are inferred.

Exploitation Scenarios

The primary attack chain for CVE-2026-78465 is client-side exploitation, consistent with the CVSS vector AV:L/AC:H/PR:N/UI:R (Local, High complexity, No privileges required, User interaction required).

Step 1 — Reconnaissance and target identification: An attacker selects a target running a 32-bit build of GIMP. This may be identified via user-agent string analysis (if the target uses GIMP for web-based image processing), via phishing reconnaissance that determines the target OS architecture, or by targeting environments known to use 32-bit Linux or Windows distributions. The attacker crafts a PCX file with an embedded payload designed to trigger the integer overflow. This file must be small enough to distribute via email (typically a few kilobytes to a few megabytes) and must have a header that declares dimensions and plane count such that width × height × 4 overflows a 32-bit integer.

Step 2 — Triggering the flaw: The malicious PCX file is delivered to the victim via crafted email attachment, a malicious link to an image-hosting site, or through a legitimate-looking file-sharing service. The victim opens the file in GIMP. The file-pcx plugin parses the header, calculates the allocation size using the overflowing arithmetic, and allocates an undersized heap buffer. As the plugin reads the pixel data from the file, it writes pixel-by-pixel into the undersized buffer, overflowing the allocated heap region.

Step 3 — Payload and execution method: At the vulnerability-class level, the heap overflow can be leveraged to overwrite adjacent heap metadata or application objects. The attacker can craft the file such that the overflow content includes attacker-controlled bytes designed to overwrite a function pointer, a GObject pointer, or heap metadata (e.g., chunk size or free-list pointer). If the overflow overwrites a function pointer that is later called by GIMP's event loop (e.g., during image display or file save), the attacker redirects control flow to a shellcode or ROP chain located in the same file's data section. Because the overflow writes sequentially from the start of the buffer, the attacker must arrange the heap layout (via heap spraying or grooming using GIMP's UI elements) so that the target object follows the vulnerable buffer in memory. This is a classic heap-exploitation technique. Alternatively, if precise control fails, the corruption of heap metadata typically triggers an unhandled segmentation fault during subsequent memory operations, resulting in a denial of service — the minimum impact guaranteed even without a functional payload.

Step 4 — Post-exploitation impact: On successful arbitrary code execution, the attacker obtains code execution in the context of the user running GIMP. If the user is an administrator, this means full system compromise. Common post-exploitation actions include installing a backdoor, exfiltrating local files (documents, credentials, cookies), or using the compromised host as a pivot into the internal network. Because GIMP is commonly used by graphic designers, photographers, and media production teams, the compromised host may contain valuable intellectual property. If code execution fails, the application crashes, causing disruption of the user's workflow and, depending on GIMP's crash-handling, the write of crash dumps to disk that may contain sensitive in-memory data.

No public PoC is available; this attack chain is inferred from the vulnerability class and the CVSS vector. The high attack complexity (AC:H) typically indicates that the attacker requires significant knowledge of heap layout or that specific conditions must be met to achieve stable exploitation, which supports the assertion that a crash (DoS) may be the more probable outcome for most attacker-crafted files.

Impact Assessment

The vulnerability presents a serious risk to users of 32-bit GIMP builds, with the CVSS base score of 7.0 (High) reflecting a combination of high impact and mitigated accessibility factors. The confidentiality, integrity, and availability impacts are all rated High (C:H/I:H/A:H), indicating that a successful exploit can result in full disclosure of local data, complete compromise of file integrity (including the ability to modify or destroy files), and total loss of availability for the affected process.

Business impact: Enterprises that support 32-bit Linux or Windows workstations — common in legacy manufacturing, embedded, or compatibility-driven environments — face a risk of wormable (if the payload includes self-propagating behavior) or targeted code execution. The lack of any patch means that affected systems remain exposed indefinitely. The requirement for user interaction (UI:R) and local access (AV:L) lowers the immediate exposure severity, but targeted phishing campaigns against design teams could succeed with a single malicious attachment. Organizations that rely on GIMP for automated image processing (scripting via Scheme or Python-Fu) are also at risk, as an automated process opening an untrusted PCX file removes the "user interaction" barrier from a functional perspective, though the CVSS still assumes a human user interacts with the file.

Blast radius: The vulnerability is confined to 32-bit builds of GIMP. This includes all operating systems that ship 32-bit binaries (Windows 7/10/11 in 32-bit mode, 32-bit Linux distributions, and 32-bit Windows Server instances). Unlike a library-level vulnerability that could affect multiple applications, this flaw is specific to the GIMP binary and its file-pcx plugin; however, any program that loads GIMP's plugins (e.g., GIMP's scripting interfaces) is also affected. The PCX format is legacy but still encountered in fax systems and some scanned documents, meaning the file format is not so obscure that opening one would raise immediate user suspicion. Given the lack of a Patch, EPSS not scored, and no CISA KEV listing, the threat is currently theoretical, but this status is expected to change once a working exploit is published.

Detection Guidance

The following detection rules are offered as candidates; they should be tested against local baseline traffic and logs before deployment. Because the vulnerability is triggered by file parsing, the primary detection vectors are network-layer file transfer detection (Suricata), endpoint file-system monitoring (Elastic, Wazuh, Splunk), and file-content structural analysis (YARA, Sigma).

Sigma Rule

title: Suspicious GIMP PCX File Parsing Activity
id: gimp-pcx-overflow-detection
status: experimental
description: Detects GIMP processing of malformed PCX files with 4 color planes and extreme dimensions, indicating possible CVE-2026-78465 exploitation.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-78465
author: ValtersIT Threat Intel Team
date: 2026/01/15
tags:
    - attack.execution
    - attack.t1203
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\gimp.exe'
            - '\gimp-2.10.exe'
        CommandLine|contains:
            - '*.pcx'
            - '*.PCX'
    condition: selection
level: medium
falsepositives:
    - Legitimate opening of PCX files by users
    - Automated GIMP scripts processing valid PCX files

Note: The Sigma rule above detects process execution with PCX file arguments, a weak proxy for the actual overflow condition. For stronger detection, combine with YARA rules on the file before it reaches the process. It is accepted that PCX processing is legitimate; this rule is only a coarse alerting mechanism.

YARA Rule

rule GIMP_FilePCX_IntegerOverflow_CVE_2026_78465
{
    meta:
        author = "ValtersIT Threat Intel"
        description = "Detect PCX files with 4 color planes and dimensions whose product exceeds 32-bit integer limit, targeting CVE-2026-78465"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-78465"
        date = "2026-01-15"
        severity = "high"
        cve = "CVE-2026-78465"

    strings:
        // Standard PCX header starts with 0x0A (manufacturer), 0x05 (version), 0x01 (encoding)
        $pcx_magic = { 0A 05 01 }
        $plane4 = { 04 00 }   // 2-byte little endian planes field = 4

    condition:
        uint8(0) == 0x0A and     
        // Xmax - Xmin (bytes 8-9 for Xmin, 10-11 for Xmax) -> width
        // Ymax - Ymin (bytes 12-13 for Ymin, 14-15 for Ymax) -> height
        uint16(8) == 0 and uint16(12) == 0 and
        uint16(10) * uint16(14) * uint16(4) > 2147483647 and   // width * height * planes > 2^31-1
        $plane4
}

Note: YARA rule targets the PCX header structure offsets. The header format uses K&R-style 16-bit little-endian fields: Xmin at offset 4, Ymin at offset 6, Xmax at offset 8, Ymax at offset 10. The above offsets need validation against the PCX specification — since the NVD description does not provide the byte offsets, this rule uses the standard PCX v5.0 header layout. Adjust offsets if your deployed parser uses a different layout. The condition assumes the file size matches the declared dimension product so that the overflow is guaranteed.

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-78465 GIMP PCX Image Download Attempt"; flow:established,to_client; file.magic:"PCX"; file.size:<5000000; content:"PCX"; fileext:"pcx"; threshold:type limit, track by_src, count 1, seconds 60; sid:20267846501; rev:1; metadata:created_at 2026_01_15, updated_at 2026_01_15, cve CVE-2026-78465;)

Note: PCX files are legacy and rarely transferred via HTTP today. This rule triggers when a PCX file is transferred over HTTP. Because the overflow condition cannot be detected at the network layer without deep file-format parsing, this rule acts as a coarse indicator of PCX files entering the network, prompting further analysis. With no known exploit-in-the-wild, this is a "hunting" rule rather than a direct exploitation detector.

Elastic Detection

// EQL rule: Detect GIMP process crashing due to heap corruption or receiving malformed PCX
sequence by process.entity_id
  [process where event.type == "start" and 
     (process.name == "gimp.exe" or process.name == "gimp-2.10.exe") and 
     process.args : "*.pcx"]
  [file where event.type == "creation" and 
     process.name == "gimp.exe" and
     file.extension : "pcx"]
  [process where event.type == "end" and 
     process.name == "gimp.exe" and 
     process.exit_code == 139] // SIGSEGV (Linux) or 0xC0000005 (Windows)

Note: EQL sequence chains GIMP start with PCX argument, file creation, then non-zero exit code (Segmentation fault on Linux, access violation on Windows). This captures the most visible outcome of heap-buffer-overflow exploitation: the crash. If an attacker achieves non-crashing code execution, this rule may not trigger. Tune the exit code to match your platform.

Splunk SPL Query

index=windows OR index=linux sourcetype=WinEventLog:Security OR sourcetype=linux_secure
| where process_name IN ("gimp.exe", "gimp-2.10.exe")
| where process_command_line LIKE "*.pcx"
| table _time, host, user, process_name, process_command_line, process_id
| stats count by host, user, process_name

Note: This SPL query searches process execution logs for GIMP launched with PCX arguments. It does not detect the overflow itself, but creates a baseline for forensic review. For stronger detection, correlate with file monitoring (Sysmon Event ID 11 for file creation, or File Integrity Monitoring) where a PCX file is written to disk immediately before GIMP launch.

Wazuh OSSEC Rule

<group name="gimp,">
    <rule id="127050" level="10">
        <if_sid>550</if_sid>   <!-- Syscheck file creation -->
        <field name="file">\.pcx$</field>
        <description>PCX file detected on disk - potentially malicious, triggering GIMP CVE-2026-78465 verification</description>
        <group>gimp,file_monitoring,</group>
    </rule>
    <rule id="127051" level="12">
        <if_sid>127050</if_sid>
        <field name="process">gimp</field>
        <description>GIMP process launched with PCX file - possible CVE-2026-78465 exploitation attempt</description>
        <group>gimp,process_monitoring,</group>
    </rule>
</group>

Note: The Wazuh rules above use file modification (Syscheck) and process correlation. They require that Syscheck monitors relevant directories and that a process_monitoring module (e.g., Auditd) is configured to capture process execution. The rules are complementary and should be calibrated to the organizational file paths.

Mitigation & Patch Guidance

Patch confidence: 0/4 — No patch evidence from any tracked source. No vendor advisory has been published, and no fix is available from the GIMP development team at the time of writing. The following actions are recommended in order of urgency.

Immediate mitigations:

1. Restrict the use of 32-bit GIMP builds. Replace with 64-bit builds if the underlying OS supports x64 architecture. Since the overflow is specifically a 32-bit arithmetic issue, migrating to 64-bit GIMP renders the crafted file ineffective (the allocation arithmetic no longer overflows) without requiring a code patch.
2. If 64-bit migration is not feasible, block the opening of PCX files via policy and user education. Enforce group-policy or Unix-level file-open restrictions. Educate users to avoid opening PCX attachments from unknown senders.
3. For automated image pipelines that use GIMP from scripts: quarantine all incoming PCX files and process them in a sandboxed environment (e.g., a disposable Linux Docker container) rather than on production hosts.
4. As the attack vector is client-side (AV:L, UI:R), enforce strict email attachment filtering to flag and strip PCX files at the mail gateway.

Patch/upgrade steps: 5. Monitor the GIMP Git repository (gitlab.gnome.org/GNOME/gimp/) and the official GIMP release notes for a patch addressing the file-pcx allocation logic. Once a fixed version is released, upgrade immediately. 6. For Linux distributions, subscribe to distribution security advisories (e.g., Ubuntu security notices, Debian DSA, RHEL errata) to be notified of the backported fix to the GIMP package. 7. In the interim, consider using an alternative 32-bit-compatible image manipulation tool (e.g., ImageMagick) for PCX handling, or use GIMP only in a 64-bit environment.

Long-term hardening: 8. Implement a formal policy requiring all client software to be 64-bit only, eliminating the 32-bit compilation path that enables this vulnerability class. 9. Add process-level memory hardening on hosts that must run 32-bit GIMP: enable ASLR (Address Space Layout Randomization) and DEP (Data Execution Prevention) where supported by the OS. These do not prevent the overflow but may raise the difficulty of successful exploitation by complicating heap-grooming and ROP-chain construction. 10. Integrate the YARA rule from this report into email and download gateways to block suspected malicious PCX files before they reach end-user systems. 11. Regularly review CISA KEV and FIRST EPSS data; if the vulnerability becomes actively exploited, these indicators will change and may re-prioritize patching efforts.

References

1. National Vulnerability Database — CVE-2026-78465: https://nvd.nist.gov/vuln/detail/CVE-2026-78465 (primary source for the vulnerability description and CVSS metrics used in this report)
2. GIMP Official Project (for future patch announcements): https://www.gimp.org/ and GitLab repository: https://gitlab.gnome.org/GNOME/gimp/
3. MITRE CVE Record: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78465
4. FIRST.org EPSS (not yet scored; monitor for future updates): https://www.first.org/epss/
5. CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE as of report date): https://www.cisa.gov/known-exploited-vulnerabilities-catalog — Note: No threat-actor campaigns or exploit-in-the-wild evidence have been reported for CVE-2026-78465 as of this writing. This section will be updated if new intelligence becomes available; refer to the source above for the authoritative status.