CVE-2026-92248

The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.

Security Fix(es):

• gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset file (CVE-2026-90947)

• gimp: gimp: heap-based buffer overflow in ICO loader via integer overflow in embedded PNG dimensions (CVE-2026-90948)

• gimp: integer overflow when generating a thumbnail preview for a PSD file (CVE-2026-92248)

• gimp: gimp: out-of-bounds write in GIMPressionist plugin via crafted preset file (CVE-2026-97185)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in the file-psd plugin in GIMP. When generating a thumbnail preview for a specially crafted PSD (Photoshop Document) image file, an integer overflow occurs during the multiplication of values from an embedded JPEG header. This leads to an undersized heap allocation, resulting in a heap-based buffer overflow when the image data is decoded. This buffer overflow corrupts adjacent heap objects, allowing for a controlled memory write that can result in an application crash or arbitrary code execution.

The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.

Security Fix(es):

• gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset file (CVE-2026-90947)
• gimp: gimp: heap-based buffer overflow in ICO loader via integer overflow in embedded PNG dimensions (CVE-2026-90948)
• gimp: integer overflow when generating a thumbnail preview for a PSD file (CVE-2026-92248)
• gimp: gimp: out-of-bounds write in GIMPressionist plugin via crafted preset file (CVE-2026-97185)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.

Security Fix(es):

• gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset file (CVE-2026-90947)
• gimp: gimp: heap-based buffer overflow in ICO loader via integer overflow in embedded PNG dimensions (CVE-2026-90948)
• gimp: integer overflow when generating a thumbnail preview for a PSD file (CVE-2026-92248)
• gimp: gimp: out-of-bounds write in GIMPressionist plugin via crafted preset file (CVE-2026-97185)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• CVE-2026-90948: compute the ICO PNG frame size and the image buffer size with g_size_checked_mul () in ico_read_png () and ico_load_image ()
• CVE-2026-90947: clamp the preset "Number of lights" to NUM_LIGHTS in the Lighting Effects load_preset_response ()
• CVE-2026-92248: bound the PSD JPEG thumbnail dimensions and compute its buffer size with g_size_checked_mul () in load_resource_1033 ()
• CVE-2026-97185: reject out-of-range vector indices in the GIMPressionist preset loader set_orient_vector () and set_size_vector ()

• CVE-2026-90948: compute the ICO PNG frame size and the image buffer size with g_size_checked_mul () in ico_read_png () and ico_load_image ()
• CVE-2026-90947: clamp the preset "Number of lights" to NUM_LIGHTS in the Lighting Effects load_preset_response ()
• CVE-2026-92248: bound the PSD JPEG thumbnail dimensions and compute its buffer size with g_size_checked_mul () in load_resource_1033 ()
• CVE-2026-97185: reject out-of-range vector indices in the GIMPressionist preset loader set_orient_vector () and set_size_vector ()

This update to v. 3.2.8 fixes several security issues.

These are all security issues fixed in the gimp-3.2.6-3.1 package on the GA media of openSUSE Tumbleweed.

This update for gimp fixes the following issues:

Changes in gimp:

• CVE-2026-18304: GIMP TIF File Parsing Integer Overflow Remote Code Execution Vulnerability (bsc#1276233)
• CVE-2026-18301: GIMP PSD File Parsing Integer Overflow Remote Code Execution Vulnerability (bsc#1276230)
• CVE-2026-18307: GIMP TIF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (bsc#1276236)
• CVE-2026-18303: GIMP TIF File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (bsc#1276232)
• CVE-2026-18308: GIMP TIF File Parsing Integer Overflow Remote Code Execution Vulnerability (bsc#1276237)
• CVE-2026-18306: GIMP SGI File Parsing Integer Overflow Remote Code Execution Vulnerability (bsc#1276235)
• CVE-2026-18305: GIMP TIF File Parsing Integer Overflow Remote Code Execution Vulnerability (bsc#1276234)
• CVE-2026-18302: GIMP TIF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (bsc#1276231)
• CVE-2026-90947: out-of-bounds write in the lighting effects plugin when processing a crafted preset file due to improper validation of the number of light sources (bsc#1280511)
• CVE-2026-90948: When processing an ICO file containing an embedded PNG image, an integer overflow can occur during the calculation of the required buffer size (bsc#1280512)
• CVE-2026-92248: When generating a thumbnail preview for a specially crafted PSD (Photoshop Document) image file, an integer overflow occurs during the multiplication of values from an embedded JPEG header (bsc#1280739)

This update for gimp fixes the following issues:

• CVE-2026-18301: Vulnerability Report at read_channel_data (bsc#1276230).
• CVE-2026-18302: TIF File Parsing Heap-based Buffer Overflow (bsc#1276231).
• CVE-2026-18303: TIF File Parsing Stack-based Buffer Overflow (bsc#1276232).
• CVE-2026-18304: TIF File Parsing Integer Overflow Remote Code Execution Vulnerability (bsc#1276233).
• CVE-2026-18305: TIF File Parsing Integer Overflow Remote Code Execution Vulnerability (bsc#1276234).
• CVE-2026-18306: SGI File Parsing Integer Overflow Remote Code Execution Vulnerability (bsc#1276235).
• CVE-2026-18307: File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (bsc#1276236).
• CVE-2026-90947: out-of-bounds write in the lighting effects plugin when processing a crafted preset file due to improper validation of the number of light sources (bsc#1280511).
• CVE-2026-90948: heap buffer overflow in the ICO loader when processing ICO files with embedded PNG images due to an integer overflow during calculation of buffer sizes (bsc#1280512).
• CVE-2026-92248: integer overflow when generating a thumbnail preview for a PSD file can lead to a heap buffer overflow (bsc#1280739).