Every CVE Search/ Get API key

CVE-2026-112257

Gimp: gimp: heap out-of-bounds read/write in psd thumbnail loader (load_resource_1033)

7.8 HighFix available

A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially arbitrary code execution when the victim browses or opens the file.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.18%Unchanged since Oct 20, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.8

Gimp: gimp: heap out-of-bounds read/write in psd thumbnail loader (load_resource_1033)

A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially arbitrary code execution when the victim browses or opens the file.

Record
CVE-2026-112257
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-121
Updated
2026-11-05
EUVDEUVD-2026-104651 7.8

A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially arbitrary code execution when the victim browses or opens the file.

Record
EUVD-2026-104651
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-05
GitHub AdvisoriesGHSA-cch8-wx4h-hxqr 7.8

A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap...

A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially arbitrary code execution when the victim browses or opens the file.

Record
GHSA-cch8-wx4h-hxqr
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-121
Updated
2026-11-05
NVD 7.8

A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially arbitrary code execution when the victim browses or opens the file.

Record
CVE-2026-112257
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-121
Updated
2026-11-05
OSVDEBIAN-CVE-2026-112257 7.8

A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially arbitrary code execution when the victim browses or opens the file.

Record
DEBIAN-CVE-2026-112257
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-05
OSVRLSA-2026:95482 7.8

Important: gimp:2.8 security, bug fix, and enhancement update

The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.

Security Fix(es):

  • gimp: gimp: heap out-of-bounds read/write in PSD thumbnail loader (load_resource_1033) (CVE-2026-112257)

Bug Fix(es) and Enhancement(s):

  • gimp: xpm poc file for CVE-2026-4154 should error differently (JIRA:Rocky Linux-178367)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:95482
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-06
OSVUBUNTU-CVE-2026-112257 7.8

A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially arbitrary code execution when the victim browses or opens the file.

Record
UBUNTU-CVE-2026-112257
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2026:93975 No score

Important: gimp security update

The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.

Security Fix(es):

  • gimp: GIMP: heap buffer overflow in DDS loader on crafted DirectDraw Surface file (CVE-2026-106062)
  • gimp: gimp: heap out-of-bounds read/write in PSD thumbnail loader (load_resource_1033) (CVE-2026-112257)
  • gimp: gimp: use-after-free in XCF loader via PROP_LINKED and PROP_SELECTION on channels (CVE-2026-112258)
  • gimp: gimp: heap out-of-bounds read in XCF text-layer parasite parsing (CVE-2026-112260)
  • gimp: gimp: use-after-free in XCF loader via PROP_SELECTED_PATH (CVE-2026-112261)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:93975
Updated
2026-11-04
OSVALSA-2026:95482 No score

Important: gimp:2.8 security, bug fix, and enhancement update

The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.

Security Fix(es):

  • gimp: gimp: heap out-of-bounds read/write in PSD thumbnail loader (load_resource_1033) (CVE-2026-112257)

Bug Fix(es) and Enhancement(s):

  • gimp: xpm poc file for CVE-2026-4154 should error differently (JIRA:RHEL-178367)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:95482
Updated
2026-11-05

Affected products

Affected packages

Affected packages
PackageAffectedFixed
gimp
AlmaLinux:9
From an advisory covering 5 CVEs
 before 2:3.0.4-4.el9_8.15
2:3.0.4-4.el9_8.15
gimp-libs
AlmaLinux:9
From an advisory covering 5 CVEs
 before 2:3.0.4-4.el9_8.15
2:3.0.4-4.el9_8.15
gimp
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2:2.8.22-26.module_el8.10.0+4352+8516153e.10
2:2.8.22-26.module_el8.10.0+4352+8516153e.10
gimp-devel
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2:2.8.22-26.module_el8.10.0+4352+8516153e.10
2:2.8.22-26.module_el8.10.0+4352+8516153e.10
gimp-devel-tools
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2:2.8.22-26.module_el8.10.0+4352+8516153e.10
2:2.8.22-26.module_el8.10.0+4352+8516153e.10
gimp-libs
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2:2.8.22-26.module_el8.10.0+4352+8516153e.10
2:2.8.22-26.module_el8.10.0+4352+8516153e.10
pygobject2
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2.28.7-5.module_el8.10.0+4267+35168c80
2.28.7-5.module_el8.10.0+4267+35168c80
pygobject2
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2.28.7-5.module_el8.10.0+4175+c208a0bf
2.28.7-5.module_el8.10.0+4175+c208a0bf
pygobject2
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2.28.7-5.module_el8.10.0+4137+2d0d25cf
2.28.7-5.module_el8.10.0+4137+2d0d25cf
pygobject2-codegen
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2.28.7-5.module_el8.10.0+4267+35168c80
2.28.7-5.module_el8.10.0+4267+35168c80
Show 37 moreShow less
Affected packages
PackageAffectedFixed
pygobject2-codegen
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2.28.7-5.module_el8.10.0+4175+c208a0bf
2.28.7-5.module_el8.10.0+4175+c208a0bf
pygobject2-devel
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2.28.7-5.module_el8.10.0+4267+35168c80
2.28.7-5.module_el8.10.0+4267+35168c80
pygobject2-devel
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2.28.7-5.module_el8.10.0+4137+2d0d25cf
2.28.7-5.module_el8.10.0+4137+2d0d25cf
pygobject2-devel
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2.28.7-5.module_el8.10.0+3952+571e801c
2.28.7-5.module_el8.10.0+3952+571e801c
pygobject2-doc
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2.28.7-5.module_el8.10.0+4267+35168c80
2.28.7-5.module_el8.10.0+4267+35168c80
pygobject2-doc
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2.28.7-5.module_el8.10.0+4137+2d0d25cf
2.28.7-5.module_el8.10.0+4137+2d0d25cf
pygtk2
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2.24.0-25.module_el8.9.0+3725+d1441900
2.24.0-25.module_el8.9.0+3725+d1441900
pygtk2-codegen
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2.24.0-25.module_el8.9.0+3725+d1441900
2.24.0-25.module_el8.9.0+3725+d1441900
pygtk2-devel
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2.24.0-25.module_el8.9.0+3725+d1441900
2.24.0-25.module_el8.9.0+3725+d1441900
pygtk2-doc
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2.24.0-25.module_el8.9.0+3725+d1441900
2.24.0-25.module_el8.9.0+3725+d1441900
python2-cairo
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.16.3-7.module_el8.10.0+4267+35168c80
1.16.3-7.module_el8.10.0+4267+35168c80
python2-cairo
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.16.3-7.module_el8.10.0+4175+c208a0bf
1.16.3-7.module_el8.10.0+4175+c208a0bf
python2-cairo
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.16.3-7.module_el8.10.0+3952+571e801c
1.16.3-7.module_el8.10.0+3952+571e801c
python2-cairo-devel
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.16.3-7.module_el8.10.0+4267+35168c80
1.16.3-7.module_el8.10.0+4267+35168c80
python2-cairo-devel
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.16.3-7.module_el8.10.0+4175+c208a0bf
1.16.3-7.module_el8.10.0+4175+c208a0bf
gimp
Debian:12
 All versions, plus listed versions
2.10.34-12.10.34-1+deb12u12.10.34-1+deb12u102.10.34-1+deb12u22.10.34-1+deb12u3
Show 45 moreShow less
2.10.34-1+deb12u42.10.34-1+deb12u52.10.34-1+deb12u62.10.34-1+deb12u72.10.34-1+deb12u82.10.34-1+deb12u92.10.36-12.10.36-22.10.36-32.10.38-12.10.38-22.99.10-12.99.12-12.99.12-22.99.14-12.99.14-22.99.16-12.99.16-22.99.18-13.0.0-13.0.0-23.0.0~RC1-13.0.0~RC1-33.0.0~RC1-43.0.0~RC2-13.0.0~RC3-13.0.2-13.0.2-23.0.2-33.0.2-3.13.0.4-13.0.4-23.0.4-33.0.4-43.0.4-53.0.4-63.0.4-6.13.0.4-6.23.0.6-13.2.0-13.2.0~RC2-13.2.0~RC2-23.2.0~RC2-33.2.0~RC2-3.13.2.0~RC2-3.2
 None known
gimp
Debian:13
 All versions, plus listed versions
3.0.4-33.0.4-3+deb13u13.0.4-3+deb13u103.0.4-3+deb13u113.0.4-3+deb13u2
Show 27 moreShow less
3.0.4-3+deb13u33.0.4-3+deb13u43.0.4-3+deb13u53.0.4-3+deb13u63.0.4-3+deb13u73.0.4-3+deb13u83.0.4-3+deb13u93.0.4-43.0.4-53.0.4-63.0.4-6.13.0.4-6.23.0.6-13.2.0-13.2.0~RC2-13.2.0~RC2-23.2.0~RC2-33.2.0~RC2-3.13.2.0~RC2-3.23.2.0~RC2-3.33.2.0~RC3-13.2.2-13.2.4-13.2.4-23.2.4-33.2.6-13.2.8-1
 None known
gimp
Debian:14
 All versions, plus listed versions
3.0.4-33.0.4-43.0.4-53.0.4-63.0.4-6.1
Show 16 moreShow less
3.0.4-6.23.0.6-13.2.0-13.2.0~RC2-13.2.0~RC2-23.2.0~RC2-33.2.0~RC2-3.13.2.0~RC2-3.23.2.0~RC2-3.33.2.0~RC3-13.2.2-13.2.4-13.2.4-23.2.4-33.2.6-13.2.8-1
 None known
gimp
Rocky Linux:8
 before 2:2.8.22-26.module+el8.10.0+1927+52edb5a0
2:2.8.22-26.module+el8.10.0+1927+52edb5a0
gimp
Rocky Linux:8
 before 2:2.8.22-26.module+el8.10.0+1998+a08ccc48.2
2:2.8.22-26.module+el8.10.0+1998+a08ccc48.2
gimp
Rocky Linux:8
 before 2:2.8.22-26.module+el8.10.0+40134+eab491b1.5
2:2.8.22-26.module+el8.10.0+40134+eab491b1.5
gimp
Rocky Linux:8
 before 2:2.8.22-26.module+el8.10.0+40407+12f45184.10
2:2.8.22-26.module+el8.10.0+40407+12f45184.10
gimp
Rocky Linux:8
 before 2:2.8.22-26.module+el8.10.0+40308+ebf9d253.8
2:2.8.22-26.module+el8.10.0+40308+ebf9d253.8
gimp
Rocky Linux:8
 before 2:2.8.22-26.module+el8.10.0+40033+6fd27379.3
2:2.8.22-26.module+el8.10.0+40033+6fd27379.3
gimp
Rocky Linux:8
 before 2:2.8.22-26.module+el8.10.0+40181+ad0e3a65.6
2:2.8.22-26.module+el8.10.0+40181+ad0e3a65.6
gimp
Rocky Linux:8
 before 2:2.8.22-26.module+el8.10.0+40075+a21479b4.4
2:2.8.22-26.module+el8.10.0+40075+a21479b4.4
gimp
Rocky Linux:8
 before 2:2.8.22-26.module+el8.10.0+40380+6ffe857b.9
2:2.8.22-26.module+el8.10.0+40380+6ffe857b.9
pygobject2
Rocky Linux:8
 before 0:2.28.7-5.module+el8.10.0+1927+52edb5a0
0:2.28.7-5.module+el8.10.0+1927+52edb5a0
pygtk2
Rocky Linux:8
 before 0:2.24.0-25.module+el8.9.0+1723+9bc93544
0:2.24.0-25.module+el8.9.0+1723+9bc93544
python2-pycairo
Rocky Linux:8
 before 0:1.16.3-7.module+el8.10.0+1927+52edb5a0
0:1.16.3-7.module+el8.10.0+1927+52edb5a0
gimp
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2.8.14-1ubuntu22.8.14-1.2ubuntu12.8.16-1ubuntu12.8.16-1ubuntu1.12.8.16-1ubuntu1.1+esm12.8.16-1ubuntu1.1+esm22.8.16-1ubuntu1.1+esm3
 None known
gimp
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.8.20-12.8.20-1.12.8.20-22.8.22-12.8.22-1ubuntu0.1~esm12.8.22-1ubuntu0.1~esm22.8.22-1ubuntu0.1~esm3
 None known
gimp
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
2.10.8-22.10.14-22.10.14-2build12.10.14-2ubuntu12.10.14-3
Show 5 moreShow less
2.10.18-12.10.18-1ubuntu0.12.10.18-1ubuntu0.1+esm12.10.18-1ubuntu0.1+esm22.10.18-1ubuntu0.1+esm3
 None known
gimp
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
2.10.24-22.10.28-12.10.30-12.10.30-1build12.10.30-1ubuntu0.12.10.30-1ubuntu0.1+esm12.10.30-1ubuntu0.1+esm22.10.30-1ubuntu0.1+esm3
 None known
gimp
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
2.10.34-12.10.36-12.10.36-22.10.36-3build22.10.36-3build3
Show 4 moreShow less
2.10.36-3ubuntu0.24.04.12.10.36-3ubuntu0.24.04.1+esm12.10.36-3ubuntu0.24.04.1+esm22.10.36-3ubuntu0.24.04.1+esm3
 None known
gimp
Ubuntu:26.10
 All versions, plus listed versions
3.2.2-13.2.4-13.2.4-23.2.4-33.2.6-1
 None known
gimp
Ubuntu:26.04:LTS
 All versions, plus listed versions
3.0.4-6.13.0.4-6.23.0.6-13.2.0~RC2-23.2.0~RC2-3
Show 7 moreShow less
3.2.0~RC2-3.13.2.0~RC2-3.23.2.0~RC2-3.33.2.0~RC3-13.2.0-13.2.2-13.2.2-1ubuntu0.26.04.1
 None known

History

History
RecordedChangedSources
affected, aliases, facts, referencesOSV
affected, facts
affected, aliases, referencesOSV
referencesCVE List, GitHub Advisories, NVD
referencesCVE List, EUVD, NVD
affected, aliases, facts, referencesEUVD, GitHub Advisories, NVD, OSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-112257 is a high vulnerability (CVSS 7.8) in Red Hat Enterprise Linux 10, published October 19, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.18%, the 7th percentile. Fixed in gimp 2:2.8.22-26.module+el8.10.0+1927+52edb5a0.

References

Show 16 moreShow less
This page doesn't list everything

Left out here: 8 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open