Executive brief
GIMP, a popular open-source image editor, contains a security flaw in how it processes Adobe Photoshop (PSD) files. By tricking a user into opening a specially crafted PSD file, an attacker could cause the application to crash or potentially execute malicious code on the user's computer. This could lead to a full system compromise or unauthorized access to the user's personal data.
Technical details
A heap buffer overflow exists in GIMP's PSD import plugin within the `read_RLE_channel()` function in `psd-load.c`. The vulnerability is caused by an integer overflow during the calculation of the `rle_pack_len` buffer size (`lyr_chn->rows * 4`) using signed 32-bit arithmetic. When a crafted PSD file specifies a large number of rows, the multiplication wraps to a small value, resulting in an undersized heap allocation via `g_malloc()`. Subsequent per-row writes in a loop then exceed the allocated buffer, leading to memory corruption. An attacker can exploit this by providing a malicious PSD file that, when opened by a user, triggers the overflow to achieve denial of service or arbitrary code execution. A fix has been committed to the upstream repository.
Affected products
- GNOME GIMP 3.2.1 and earlier versions up to commit aa1a29d
- Red Hat Red Hat Enterprise Linux 9 affected
Timeline
- 2026-04-12: other: Vulnerability confirmed in upstream source commit aa1a29d
- 2026-07-06: disclosed: Bug reported to Red Hat Bugzilla
- 2026-07-07: advisory: CVE published by NVD and Red Hat
- 2026-07-07: patched: Upstream fix committed to GNOME GitLab