Heap Buffer Overflow in GIMP DDS File Parser

CVE-2026-42170 is a heap-based buffer overflow vulnerability in GIMP's DirectDraw Surface (DDS) file parser that exploits a mismatch between declared pixel format and actual bits-per-pixel values in crafted files. When a malicious DDS file specifies a D3D9 pixel format but declares a lower bpp value in its header, GIMP allocates an undersized heap buffer. As the parser consumes pixel data using the real format's stride, writes overflow the buffer boundary, corrupting heap metadata and potentially enabling arbitrary code execution. This vulnerability affects GIMP users who process untrusted DDS files, making it a concern for digital artists, game developers, and anyone using GIMP in environments where DDS files may originate from untrusted sources.

While this CVE does not map directly to MITRE ATT&CK techniques, Casky's AI-driven analysis identifies related attack patterns through its 754 mapped security skills. Practitioners using Casky would observe detection patterns aligned with CWE-131 (Incorrect Buffer Size Calculation) and related memory corruption indicators. The platform's extended reasoning capabilities would flag suspicious DDS file handling—such as header validation bypasses, stride mismatches between declared and actual formats, and heap allocation anomalies—as precursors to exploitation attempts. Findings would highlight the need for input validation controls, heap protection mechanisms (ASLR, DEP), and sandboxing of file parsing operations to mitigate similar memory safety vulnerabilities.