# CVE-2026-58381: GNOME GIMP double-free in PSP file format parser

Source: https://junglewise.ai/threats/cve-2026-58381-gnome-gimp-double-free-in-psp-file-format-parser  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-02. Updated: 2026-07-02  
License: CC BY 4.0 with a link back

CVE-2026-58381 · Severity: medium · CVSS 6.1 · Published 2026-07-02

GIMP, a popular open-source image editor, contains a security flaw in how it handles Paint Shop Pro (PSP) files. If a user is tricked into opening a specially crafted, malicious PSP file, the application could crash or potentially allow an attacker to take control of the system. This vulnerability impacts the reliability of the software and could be used as a starting point for further attacks on a user's computer.

## Quick answers

**Is CVE-2026-58381 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-58381 being exploited in the wild.

**How severe is CVE-2026-58381?** Medium severity, with a CVSS score of 6.1, published 2 July 2026.

**Which products and versions are affected?** GNOME GIMP 3.2.1; Red Hat Red Hat Enterprise Linux 7 affected; Red Hat Red Hat Enterprise Linux 8 affected; Red Hat Red Hat Enterprise Linux 9 affected.

**Is there a fix for CVE-2026-58381?** A patch was published on 2026-07-02: Upstream fix committed to GNOME GitLab repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-58381 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-58381?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A double-free vulnerability exists in GIMP's PSP file format parser within the 'read_layer_block()' function in 'plug-ins/common/file-psp.c'. The flaw is caused by a failure to reset a pointer ('name') to NULL at the start of a processing loop. When a specially crafted PSP file triggers an error (such as a truncated file) during the second iteration of the loop, the 'fread' operation fails before a new memory allocation occurs. This causes the error-handling path to call 'g_free()' on a pointer that was already freed at the end of the previous iteration. An attacker can exploit this via a local attack vector requiring user interaction (opening a file) to cause a denial of service or achieve arbitrary code execution through heap corruption. A fix has been committed to the upstream GNOME GIMP repository.

## Affected products

- GNOME GIMP 3.2.1
- Red Hat Red Hat Enterprise Linux 7 affected
- Red Hat Red Hat Enterprise Linux 8 affected
- Red Hat Red Hat Enterprise Linux 9 affected

## Timeline

- 2026-07-01: disclosed: Reported to Red Hat Bugzilla
- 2026-07-02: advisory: NVD and Red Hat published advisory details
- 2026-07-02: patched: Upstream fix committed to GNOME GitLab repository

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-58381](https://access.redhat.com/security/cve/CVE-2026-58381)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2496166](https://bugzilla.redhat.com/show_bug.cgi?id=2496166)
- [https://gitlab.gnome.org/GNOME/gimp/-/commit/b22e147b](https://gitlab.gnome.org/GNOME/gimp/-/commit/b22e147b)
- [https://gitlab.gnome.org/GNOME/gimp/-/issues/16207](https://gitlab.gnome.org/GNOME/gimp/-/issues/16207)