CVE-2026-42170

Name of the Vulnerable Software and Affected Versions GIMP (affected versions not specified)

Description A heap-based buffer overflow occurs in the DDS (DirectDraw Surface) file parser. The issue arises when a crafted DDS file specifies a D3D9 pixel format but provides a lower bits-per-pixel (bpp) value in the header. This causes the loader to allocate an undersized heap buffer. When the system subsequently consumes pixel data using the actual format's stride, it writes beyond the heap buffer boundary, resulting in heap metadata corruption and potential arbitrary code execution. This process occurs within the load layer() function located in ddsread.c.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.