Hi,

The following vulnerability was published for gimp.

CVE-2026-106062[0]:
| A heap-based buffer overflow was found in GIMP’s DirectDraw Surface
| (DDS) loader. When loading a crafted DDS image, buffer sizes derived
| from width, height, and pitch can be computed using 32-bit
| arithmetic that overflows. The allocated buffer is too small for the
| amount of pixel data written through GEGL (CWE-787), following
| integer overflow in size calculations (CWE-190). This may allow heap
| corruption and, in the worst case, arbitrary code execution in the
| context of the GIMP process.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-106062
https://www.cve.org/CVERecord?id=CVE-2026-106062
[1] https://bugzilla.redhat.com/show_bug.cgi?id=2546654
[2] https://gitlab.gnome.org/GNOME/gimp/-/work_items/16801
[3] https://gitlab.gnome.org/GNOME/gimp/-/merge_requests/3045

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
gimp, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1150242@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Jeremy Bícha <jbicha@ubuntu.com> (supplier of updated gimp package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Wed, 04 Nov 2026 13:19:24 +0100
Source: gimp
Built-For-Profiles: derivative.ubuntu noudeb
Architecture: source
Version: 3.2.8-1
Distribution: unstable
Urgency: high
Maintainer: Debian GNOME Extras Maintainers <pkg-gnome-extras-maintainers@lists.alioth.debian.org>
Changed-By: Jeremy Bícha <jbicha@ubuntu.com>
Closes: 1148477 1148479 1148480 1148895 1148969 1149674 1150241 1150242 1150243 1150339 1150340 1150341 1150342 1150497 1152636
Changes:
 gimp (3.2.8-1) unstable; urgency=high
 .
   * New upstream release
     - https://www.gimp.org/news/2026/11/02/gimp-3-2-8-released/
     - CVE-2026-90948 (Closes: #1148480)
     - CVE-2026-90949 (Closes: #1148479)
     - CVE-2026-92248 (Closes: #1148477)
     - CVE-2026-96544 (Closes: #1149674)
     - CVE-2026-96545 (Closes: #1148895)
     - CVE-2026-97185 (Closes: #1148969)
     - CVE-2026-106061 (Closes: #1150241)
     - CVE-2026-106062 (Closes: #1150242)
     - CVE-2026-106063 (Closes: #1150243)
     - CVE-2026-106064 (Closes: #1150339)
     - CVE-2026-106065 (Closes: #1150340)
     - CVE-2026-106066 (Closes: #1150341)
     - CVE-2026-106067 (Closes: #1150342)
     - CVE-2026-108093 (Closes: #1150497)
     - CVE-2026-112257
     - CVE-2026-112258
     - CVE-2026-112260
     - CVE-2026-112261
     - CVE-2026-119528 (Closes: #1152636)
   * Cherry-pick a release notes fix
   * Remove all other cherry-picked patches: applied in new release
Checksums-Sha1:
 c805d5d9894d30f1291aa80af082e6ff38e170d4 3901 gimp_3.2.8-1.dsc
 ec66004ae1fa8115b3eea0f9f1bb2d50c21e2ae8 35071988 gimp_3.2.8.orig.tar.xz
 6d3413abe98f55ac65a6ad59b11a4e7c2ebfd528 68272 gimp_3.2.8-1.debian.tar.xz
 1b0bb91bcb6fbbabeaf358539872f9eda12ba986 11713 gimp_3.2.8-1_source.buildinfo
Checksums-Sha256:
 e86ef0fb27a04660497164ee5be877a27af04f4e1165a4d0fbf24213112e946c 3901 gimp_3.2.8-1.dsc
 16a2696cadc9e03a2ef97ccb895e062f654cb2b8211fb57074db85f26646c847 35071988 gimp_3.2.8.orig.tar.xz
 b1f2120f052b101bac695f5012416a6da350036f0c925aff554c0ebe74e8720d 68272 gimp_3.2.8-1.debian.tar.xz
 e106feee7e771d59f570c2a3a6418395ad7978287fb011a1b769f5adcb5381bd 11713 gimp_3.2.8-1_source.buildinfo
Files:
 229392ba9e848a385b310a84daf138ef 3901 graphics optional gimp_3.2.8-1.dsc
 04f314be47de07c48d294fa52cdf60a4 35071988 graphics optional gimp_3.2.8.orig.tar.xz
 78d6d217e2726508f2e43573ffc7ad30 68272 graphics optional gimp_3.2.8-1.debian.tar.xz
 841b789d074c163204db605323d8c356 11713 graphics optional gimp_3.2.8-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEETQvhLw5HdtiqzpaW5mx3Wuv+bH0FAmrrKvAACgkQ5mx3Wuv+
bH2aNA//VG9rxYzDl/zhicEgSX0QOVypOiIQERvwdWKx6egG6OqfB6DBk+VDk+e7
9gUAJqk2/18UFoxG/3judT+JI913gB5mfMkLPPAztTS+9WIUyd2CyRmZIQp4t16P
Vgd5sYEK2LifeK2yZRBz42/g9Vr0emUuSCppEJejzxXXFdAE96XDGiMyx9KtybSy
VOYyZ+V3dSTI2T3EgTQwm1Gq0Ot4SnwTfz9EpYzHEMBwdI/jgeAHjCPb8+RNJQvJ
tupX0hOcxVxy1vaIkdPoZ7pYfA4NA9t/7D484Hk6ZmIVuU9TKMzGdQZbtSIWEjlW
KCGGE5MLlAX13QlinX3Ho9FJrIpj+sTmb9hQBwqC9bh4BmSRwIy0yd6+uAUrcs5V
kZjaYKkVc1z2xPvZuGDmoUiLYuH2h4A2edie8oylZOv3qh7Yftw0dFDMyUGSSYsw
JBXYwyUARjkgR975TuLh+ov0sLeonBPll3kl4pEhCmfwDBATDl3varB76fPqEY+F
eiqpfiOS/nnpu7+YPC9MOHtwITUBQDfiKV5CoTygY3egt0q9qL1uN4q4wKpWl/3D
ilPAo4djg7Ib2F/KCNHHeY14rXE9Ut91eQCBNab2xSqn+7QDb0dM4ugNrwQj/g1+
Ff4K9pqfuSOVw8LCrLTk1LFN7DBvWaH+bcXHkh1J2qACb7KRY8Q=
=aRdz
-----END PGP SIGNATURE-----