CVE-2026-82343
Gimp: heap out-of-bounds read and stack out-of-bounds access in psd loader from channel-count handling
A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image file, the plugin does not properly validate the channel-count parameter. This incorrect validation leads to improper memory bounds checking, resulting in both a heap out-of-bounds read and a stack out-of-bounds access. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of memory contents.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Gimp: heap out-of-bounds read and stack out-of-bounds access in psd loader from channel-count handling
A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image file, the plugin does not properly validate the channel-count parameter. This incorrect validation leads to improper memory bounds checking, resulting in both a heap out-of-bounds read and a stack out-of-bounds access. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of memory contents.
- Record
CVE-2026-82343- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Weakness
- CWE-120
- Updated
- 2026-11-06
EUVDEUVD-2026-67826
A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image file, the plugin does not properly validate the channel-count parameter. This incorrect validation leads to improper memory bounds checking, resulting in both a heap out-of-bounds read and a stack out-of-bounds access. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of memory contents.
- Record
EUVD-2026-67826- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Updated
- 2026-11-06
GitHub AdvisoriesGHSA-cj7r-2p4g-x2hx
A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image...
A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image file, the plugin does not properly validate the channel-count parameter. This incorrect validation leads to improper memory bounds checking, resulting in both a heap out-of-bounds read and a stack out-of-bounds access. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of memory contents.
- Record
GHSA-cj7r-2p4g-x2hx- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
NVD
A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image file, the plugin does not properly validate the channel-count parameter. This incorrect validation leads to improper memory bounds checking, resulting in both a heap out-of-bounds read and a stack out-of-bounds access. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of memory contents.
- Record
CVE-2026-82343- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Weakness
- CWE-120
- Updated
- 2026-11-06
OSVDEBIAN-CVE-2026-82343
A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image file, the plugin does not properly validate the channel-count parameter. This incorrect validation leads to improper memory bounds checking, resulting in both a heap out-of-bounds read and a stack out-of-bounds access. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of memory contents.
- Record
DEBIAN-CVE-2026-82343- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Updated
- 2026-11-06
OSVUBUNTU-CVE-2026-82343
A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image file, the plugin does not properly validate the channel-count parameter. This incorrect validation leads to improper memory bounds checking, resulting in both a heap out-of-bounds read and a stack out-of-bounds access. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of memory contents.
- Record
UBUNTU-CVE-2026-82343- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVCLSA-2026-1789142941 No score
gimp: Fix of 2 CVEs
- CVE-2026-80101: size the XWD 1-bit scanline buffers on the number of bytes the decode loops actually read, ceil(width / 8), instead of trusting l_bytes_per_line alone, and zero-fill them; the upstream guard is re-authored because its own arithmetic is inoperative
- CVE-2026-82343: reject PSD files whose declared channel count is below the minimum required by the color mode, so the merged image is no longer read with more bytes per pixel than were allocated (upstream's channel_idx array enlargement is not applicable: that write path does not exist in 2.99.8)
- Record
CLSA-2026-1789142941- Updated
- 2026-11-02
OSVCLSA-2026-1789144988 No score
gimp: Fix of 2 CVEs
- CVE-2026-80101: size the XWD 1-bit scanline buffers on the number of bytes the decode loops actually read, ceil(width / 8), instead of trusting l_bytes_per_line alone, and zero-fill them; the upstream guard is re-authored because its own arithmetic is inoperative
- CVE-2026-82343: reject PSD files whose declared channel count is below the minimum required by the color mode, so the merged image is no longer read with more bytes per pixel than were allocated (upstream's channel_idx array enlargement is not applicable: that write path does not exist in 2.99.8)
- Record
CLSA-2026-1789144988- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:22123-1 No score
Security update for gimp
This update for gimp fixes the following issues:
Changes in gimp:
- CVE-2026-106061: plug-ins: Bound allocation for XMC import (bsc#1284473)
- CVE-2026-106062: plug-ins/file-dds: fix out of bounds write (bsc#1284474)
- CVE-2026-106063: plug-ins: Add bounds checks for DICOM export (bsc#1284475)
- CVE-2026-82324: plug-ins: Add more checks for IFF import (bsc#1277594)
- CVE-2026-82328: plug-ins: Use BPP for ICO palette allocation (bsc#1277618)
- CVE-2026-82343: plug-ins: fix heap out of bounds in PSD loader (bsc#1277622)
- Record
openSUSE-SU-2026:22123-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:4895-1 No score
Security update for gimp
This update for gimp fixes the following issues:
- CVE-2026-82328: undersized palette memory allocations in the ICO loader can cause heap out-of-bounds reads (bsc#1277618).
- CVE-2026-82343: improper channel-count handling in the PSD loader can cause heap and stack out-of-bounds reads (bsc#1277622).
- CVE-2026-106061: integer overflow in the X cursor thumbnail loader leads to out-of-bounds read and process crash when generating a thumbnail for a crafted XMC file (bsc#1284473).
- CVE-2026-106062: heap-based buffer overflow in DirectDraw Surface loader when loading a crafted DDS image (bsc#1284474).
- CVE-2026-106063: heap-based buffer overflow in the DICOM export plug-in when exporting an image with extremely large width and height (bsc#1284475).
- Record
SUSE-SU-2026:4895-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gimpTuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs |
before 2:2.99.8-4.el9.2.tuxcare.els20 | 2:2.99.8-4.el9.2.tuxcare.els20 |
gimp-develTuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs |
before 2:2.99.8-4.el9.2.tuxcare.els20 | 2:2.99.8-4.el9.2.tuxcare.els20 |
gimp-devel-toolsTuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs |
before 2:2.99.8-4.el9.2.tuxcare.els20 | 2:2.99.8-4.el9.2.tuxcare.els20 |
gimp-libsTuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs |
before 2:2.99.8-4.el9.2.tuxcare.els20 | 2:2.99.8-4.el9.2.tuxcare.els20 |
gimpTuxCare:AlmaLinux:9.6 From an advisory covering 2 CVEs |
before 2:2.99.8-4.el9_6.2.tuxcare.els20 | 2:2.99.8-4.el9_6.2.tuxcare.els20 |
gimp-develTuxCare:AlmaLinux:9.6 From an advisory covering 2 CVEs |
before 2:2.99.8-4.el9_6.2.tuxcare.els20 | 2:2.99.8-4.el9_6.2.tuxcare.els20 |
gimp-devel-toolsTuxCare:AlmaLinux:9.6 From an advisory covering 2 CVEs |
before 2:2.99.8-4.el9_6.2.tuxcare.els20 | 2:2.99.8-4.el9_6.2.tuxcare.els20 |
gimp-libsTuxCare:AlmaLinux:9.6 From an advisory covering 2 CVEs |
before 2:2.99.8-4.el9_6.2.tuxcare.els20 | 2:2.99.8-4.el9_6.2.tuxcare.els20 |
gimpDebian:12 |
All versions, plus listed versions 2.10.34-12.10.34-1+deb12u12.10.34-1+deb12u102.10.34-1+deb12u22.10.34-1+deb12u3 Show 45 moreShow less2.10.34-1+deb12u42.10.34-1+deb12u52.10.34-1+deb12u62.10.34-1+deb12u72.10.34-1+deb12u82.10.34-1+deb12u92.10.36-12.10.36-22.10.36-32.10.38-12.10.38-22.99.10-12.99.12-12.99.12-22.99.14-12.99.14-22.99.16-12.99.16-22.99.18-13.0.0-13.0.0-23.0.0~RC1-13.0.0~RC1-33.0.0~RC1-43.0.0~RC2-13.0.0~RC3-13.0.2-13.0.2-23.0.2-33.0.2-3.13.0.4-13.0.4-23.0.4-33.0.4-43.0.4-53.0.4-63.0.4-6.13.0.4-6.23.0.6-13.2.0-13.2.0~RC2-13.2.0~RC2-23.2.0~RC2-33.2.0~RC2-3.13.2.0~RC2-3.2 |
None known |
gimpDebian:13 |
All versions, plus listed versions 3.0.4-33.0.4-3+deb13u13.0.4-3+deb13u103.0.4-3+deb13u113.0.4-3+deb13u2 Show 27 moreShow less3.0.4-3+deb13u33.0.4-3+deb13u43.0.4-3+deb13u53.0.4-3+deb13u63.0.4-3+deb13u73.0.4-3+deb13u83.0.4-3+deb13u93.0.4-43.0.4-53.0.4-63.0.4-6.13.0.4-6.23.0.6-13.2.0-13.2.0~RC2-13.2.0~RC2-23.2.0~RC2-33.2.0~RC2-3.13.2.0~RC2-3.23.2.0~RC2-3.33.2.0~RC3-13.2.2-13.2.4-13.2.4-23.2.4-33.2.6-13.2.8-1 |
None known |
Show 11 moreShow less
| Package | Affected | Fixed |
|---|---|---|
gimpDebian:14 |
before 3.2.6-1, plus listed versions 3.0.4-33.0.4-43.0.4-53.0.4-63.0.4-6.1 Show 14 moreShow less3.0.4-6.23.0.6-13.2.0-13.2.0~RC2-13.2.0~RC2-23.2.0~RC2-33.2.0~RC2-3.13.2.0~RC2-3.23.2.0~RC2-3.33.2.0~RC3-13.2.2-13.2.4-13.2.4-23.2.4-3 |
3.2.6-1 |
gimpSUSE:Linux Enterprise Module for Package Hub 15 SP7 From an advisory covering 5 CVEs |
before 2.10.30-150400.3.85.1 | 2.10.30-150400.3.85.1 |
gimpSUSE:Linux Enterprise Workstation Extension 15 SP7 From an advisory covering 5 CVEs |
before 2.10.30-150400.3.85.1 | 2.10.30-150400.3.85.1 |
gimpUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.8.14-1ubuntu22.8.14-1.2ubuntu12.8.16-1ubuntu12.8.16-1ubuntu1.12.8.16-1ubuntu1.1+esm12.8.16-1ubuntu1.1+esm22.8.16-1ubuntu1.1+esm3 |
None known |
gimpUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.8.20-12.8.20-1.12.8.20-22.8.22-12.8.22-1ubuntu0.1~esm12.8.22-1ubuntu0.1~esm22.8.22-1ubuntu0.1~esm3 |
None known |
gimpUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2.10.8-22.10.14-22.10.14-2build12.10.14-2ubuntu12.10.14-3 Show 5 moreShow less2.10.18-12.10.18-1ubuntu0.12.10.18-1ubuntu0.1+esm12.10.18-1ubuntu0.1+esm22.10.18-1ubuntu0.1+esm3 |
None known |
gimpUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 2.10.24-22.10.28-12.10.30-12.10.30-1build12.10.30-1ubuntu0.12.10.30-1ubuntu0.1+esm12.10.30-1ubuntu0.1+esm22.10.30-1ubuntu0.1+esm3 |
None known |
gimpUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 2.10.34-12.10.36-12.10.36-22.10.36-3build22.10.36-3build3 Show 4 moreShow less2.10.36-3ubuntu0.24.04.12.10.36-3ubuntu0.24.04.1+esm12.10.36-3ubuntu0.24.04.1+esm22.10.36-3ubuntu0.24.04.1+esm3 |
None known |
gimpUbuntu:26.10 |
All versions, plus listed versions 3.2.2-13.2.4-13.2.4-23.2.4-33.2.6-1 |
None known |
gimpUbuntu:26.04:LTS |
All versions, plus listed versions 3.0.4-6.13.0.4-6.23.0.6-13.2.0~RC2-23.2.0~RC2-3 Show 7 moreShow less3.2.0~RC2-3.13.2.0~RC2-3.23.2.0~RC2-3.33.2.0~RC3-13.2.0-13.2.2-13.2.2-1ubuntu0.26.04.1 |
None known |
gimpopenSUSE:Leap 16.0 From an advisory covering 6 CVEs |
before 3.0.8-bp160.13.1 | 3.0.8-bp160.13.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | OSV | |
| affected | CVE List, NVD | |
| facts | EUVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-82343 is a medium vulnerability (CVSS 6.1) in Gimp, published August 28, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.18%, the 7th percentile. Fixed in gimp 3.2.6-1.
References
access.redhat.com/security/cve/CVE-2026-82343
bugzilla.redhat.com/show_bug.cgi?id=2525644
gitlab.gnome.org/GNOME/gimp/-/work_items/16587
nvd.nist.gov/vuln/detail/CVE-2026-82343
github.com/advisories/GHSA-cj7r-2p4g-x2hx
errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1789142941.html
Show 18 moreShow less
security-tracker.debian.org/tracker/CVE-2026-82343
suse.com/support/update/announcement/2026/suse-su-20264895-1
bugzilla.suse.com/1277618
ubuntu.com/security/CVE-2026-82343
cve.org/CVERecord?id=CVE-2026-82343
Left out here: 8 versions. The JSON record has them.