Executive brief
GIMP is a widely-used image editor that supports many file formats, including Adobe Photoshop's PSD format. A bug in GIMP's PSD parser allows an attacker to craft a malicious image file that, when opened, executes arbitrary code on the victim's computer with the privileges of the user running GIMP.
Technical details
An unsigned integer underflow exists in the `block_rem` variable within GIMP's PSD file format plugin. The vulnerability is triggered when parsing a specially crafted PSD file, causing parser confusion that enables an attacker to inject arbitrary data into layer resource blocks. This memory corruption flaw can be exploited to achieve arbitrary code execution. The attack requires user interaction (opening a malicious file) and no authentication. Patches should be available from GIMP/GNOME.
Affected products
- GIMP GIMP <UNKNOWN>
Timeline
- 2026-08-10: disclosed