CVE-2026-62439 is a high severity (CVSS 7.0) integer overflow in the file-pvr plug-in of GIMP. Opening or previewing a crafted PowerVR (.pvr) file can cause a heap overflow, leading to a crash or possibly code execution. A fixed version was not confirmed in the sources, so check your distribution.
What's affected
The record names GIMP's file-pvr plug-in and gives no version range. The Red Hat entry and Bugzilla report describe the same flaw, published 16 October 2026, and mark it CWE-190 (integer overflow or wraparound). They also give 7.0 High with a local attack vector, high complexity and user interaction required.
The Bugzilla text explains the cause: a buffer size is computed in 32-bit arithmetic from the file's declared dimensions, and the result can wrap to a small number while the later write uses the large one. That produces a heap-based buffer overflow.
No fixed GIMP version is stated in the pages reviewed here, and the upstream issue page could not be retrieved. Do not assume a version. Check the GIMP issue linked in the sources and your distribution's security tracker for the build that carries the fix.
How to check if you're exposed
Find out whether GIMP is installed, and which build.
gimp --version
rpm -q gimp 2>/dev/null
dpkg -s gimp 2>/dev/null | grep Version
flatpak list 2>/dev/null | grep -i gimp
Then look at your distribution's security tracker for this CVE id to see whether a patched package exists. Because the issue is in an optional file format plug-in, some builds may not ship it; check your package contents if that matters to you.
Whatever the product, a current inventory of what you run is what turns a CVE notice into a quick answer. The Gold page for this CVE tracks how its record changes over time, and the free in-browser dependency scan at gold.safeguard.sh/scan covers the application libraries you ship.
What to do now
- List workstations and build servers that have GIMP installed, including Flatpak and Snap copies.
- Apply the patched package when your distribution or the GIMP project releases one, and confirm the version against the advisory.
- Until then, do not open .pvr files from untrusted sources and do not let file managers generate previews for them.
- Consider removing the file-pvr plug-in on shared or sensitive systems if you do not use that format.
- Set a reminder to recheck the Red Hat and GIMP entries, because the fix status was still unconfirmed at the time of review.
Why it matters
Integer overflows are quiet bugs. The arithmetic does not fail; it just returns a smaller number than expected, and the next step trusts it. When the number is a memory size, the program allocates too little and then writes as if it had allocated enough. The class is CWE-190.
This one needs a person to open or preview a file, so it is a desktop risk more than a server risk. Image tools that run automatically over uploaded files, such as thumbnail generators, are the exception worth checking. The record does not mark this CVE as exploited in the wild.
Quick check
Is there a fixed GIMP version I can install today?
The sources reviewed do not state one. Check the linked GIMP issue and your distribution's tracker. Do not rely on a version number from a third party that you cannot confirm.
Sources
Last reviewed: 18 October 2026.
