CVE-2026-112257
Gimp: gimp: heap out-of-bounds read/write in psd thumbnail loader (load_resource_1033)
CVE-2026-112257 is a high vulnerability (CVSS 7.8) in Red Hat Enterprise Linux 10, published October 19, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.18%, the 7th percentile. Fixed in gimp 3.2.8-1.
- Severity
- 7.8 HighCVSS 3.1, CVE List
- Exploit chance
- 0.18%EPSS, 7th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
3.2.8-1gimp +83 more
Description
A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially arbitrary code execution when the victim browses or opens the file.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gimpAlmaLinux:9 From an advisory covering 5 CVEs | before 2:3.0.4-4.el9_8.15 | 2:3.0.4-4.el9_8.15 |
gimp-libsAlmaLinux:9 From an advisory covering 5 CVEs | before 2:3.0.4-4.el9_8.15 | 2:3.0.4-4.el9_8.15 |
gimpAlmaLinux:8 From an advisory covering 2 CVEs | before 2:2.8.22-26.module_el8.10.0+4352+8516153e.10 | 2:2.8.22-26.module_el8.10.0+4352+8516153e.10 |
gimp-develAlmaLinux:8 From an advisory covering 2 CVEs | before 2:2.8.22-26.module_el8.10.0+4352+8516153e.10 | 2:2.8.22-26.module_el8.10.0+4352+8516153e.10 |
gimp-devel-toolsAlmaLinux:8 From an advisory covering 2 CVEs | before 2:2.8.22-26.module_el8.10.0+4352+8516153e.10 | 2:2.8.22-26.module_el8.10.0+4352+8516153e.10 |
gimp-libsAlmaLinux:8 From an advisory covering 2 CVEs | before 2:2.8.22-26.module_el8.10.0+4352+8516153e.10 | 2:2.8.22-26.module_el8.10.0+4352+8516153e.10 |
pygobject2AlmaLinux:8 From an advisory covering 2 CVEs | before 2.28.7-5.module_el8.10.0+4267+35168c80 | 2.28.7-5.module_el8.10.0+4267+35168c80 |
pygobject2AlmaLinux:8 From an advisory covering 2 CVEs | before 2.28.7-5.module_el8.10.0+4175+c208a0bf | 2.28.7-5.module_el8.10.0+4175+c208a0bf |
pygobject2AlmaLinux:8 From an advisory covering 2 CVEs | before 2.28.7-5.module_el8.10.0+4137+2d0d25cf | 2.28.7-5.module_el8.10.0+4137+2d0d25cf |
pygobject2-codegenAlmaLinux:8 From an advisory covering 2 CVEs | before 2.28.7-5.module_el8.10.0+4267+35168c80 | 2.28.7-5.module_el8.10.0+4267+35168c80 |
Show 74 moreShow less
| Package | Affected | Fixed |
|---|---|---|
pygobject2-codegenAlmaLinux:8 From an advisory covering 2 CVEs | before 2.28.7-5.module_el8.10.0+4175+c208a0bf | 2.28.7-5.module_el8.10.0+4175+c208a0bf |
pygobject2-develAlmaLinux:8 From an advisory covering 2 CVEs | before 2.28.7-5.module_el8.10.0+4267+35168c80 | 2.28.7-5.module_el8.10.0+4267+35168c80 |
pygobject2-develAlmaLinux:8 From an advisory covering 2 CVEs | before 2.28.7-5.module_el8.10.0+4137+2d0d25cf | 2.28.7-5.module_el8.10.0+4137+2d0d25cf |
pygobject2-develAlmaLinux:8 From an advisory covering 2 CVEs | before 2.28.7-5.module_el8.10.0+3952+571e801c | 2.28.7-5.module_el8.10.0+3952+571e801c |
pygobject2-docAlmaLinux:8 From an advisory covering 2 CVEs | before 2.28.7-5.module_el8.10.0+4267+35168c80 | 2.28.7-5.module_el8.10.0+4267+35168c80 |
pygobject2-docAlmaLinux:8 From an advisory covering 2 CVEs | before 2.28.7-5.module_el8.10.0+4137+2d0d25cf | 2.28.7-5.module_el8.10.0+4137+2d0d25cf |
pygtk2AlmaLinux:8 From an advisory covering 2 CVEs | before 2.24.0-25.module_el8.9.0+3725+d1441900 | 2.24.0-25.module_el8.9.0+3725+d1441900 |
pygtk2-codegenAlmaLinux:8 From an advisory covering 2 CVEs | before 2.24.0-25.module_el8.9.0+3725+d1441900 | 2.24.0-25.module_el8.9.0+3725+d1441900 |
pygtk2-develAlmaLinux:8 From an advisory covering 2 CVEs | before 2.24.0-25.module_el8.9.0+3725+d1441900 | 2.24.0-25.module_el8.9.0+3725+d1441900 |
pygtk2-docAlmaLinux:8 From an advisory covering 2 CVEs | before 2.24.0-25.module_el8.9.0+3725+d1441900 | 2.24.0-25.module_el8.9.0+3725+d1441900 |
python2-cairoAlmaLinux:8 From an advisory covering 2 CVEs | before 1.16.3-7.module_el8.10.0+4267+35168c80 | 1.16.3-7.module_el8.10.0+4267+35168c80 |
python2-cairoAlmaLinux:8 From an advisory covering 2 CVEs | before 1.16.3-7.module_el8.10.0+4175+c208a0bf | 1.16.3-7.module_el8.10.0+4175+c208a0bf |
python2-cairoAlmaLinux:8 From an advisory covering 2 CVEs | before 1.16.3-7.module_el8.10.0+3952+571e801c | 1.16.3-7.module_el8.10.0+3952+571e801c |
python2-cairo-develAlmaLinux:8 From an advisory covering 2 CVEs | before 1.16.3-7.module_el8.10.0+4267+35168c80 | 1.16.3-7.module_el8.10.0+4267+35168c80 |
python2-cairo-develAlmaLinux:8 From an advisory covering 2 CVEs | before 1.16.3-7.module_el8.10.0+4175+c208a0bf | 1.16.3-7.module_el8.10.0+4175+c208a0bf |
gimpDebian:12 | All versions, plus listed versions 2.10.34-12.10.34-1+deb12u12.10.34-1+deb12u102.10.34-1+deb12u22.10.34-1+deb12u3 Show 45 moreShow less2.10.34-1+deb12u42.10.34-1+deb12u52.10.34-1+deb12u62.10.34-1+deb12u72.10.34-1+deb12u82.10.34-1+deb12u92.10.36-12.10.36-22.10.36-32.10.38-12.10.38-22.99.10-12.99.12-12.99.12-22.99.14-12.99.14-22.99.16-12.99.16-22.99.18-13.0.0-13.0.0-23.0.0~RC1-13.0.0~RC1-33.0.0~RC1-43.0.0~RC2-13.0.0~RC3-13.0.2-13.0.2-23.0.2-33.0.2-3.13.0.4-13.0.4-23.0.4-33.0.4-43.0.4-53.0.4-63.0.4-6.13.0.4-6.23.0.6-13.2.0-13.2.0~RC2-13.2.0~RC2-23.2.0~RC2-33.2.0~RC2-3.13.2.0~RC2-3.2 | None known |
gimpDebian:13 | All versions, plus listed versions 3.0.4-33.0.4-3+deb13u13.0.4-3+deb13u103.0.4-3+deb13u113.0.4-3+deb13u2 Show 27 moreShow less3.0.4-3+deb13u33.0.4-3+deb13u43.0.4-3+deb13u53.0.4-3+deb13u63.0.4-3+deb13u73.0.4-3+deb13u83.0.4-3+deb13u93.0.4-43.0.4-53.0.4-63.0.4-6.13.0.4-6.23.0.6-13.2.0-13.2.0~RC2-13.2.0~RC2-23.2.0~RC2-33.2.0~RC2-3.13.2.0~RC2-3.23.2.0~RC2-3.33.2.0~RC3-13.2.2-13.2.4-13.2.4-23.2.4-33.2.6-13.2.8-1 | None known |
gimpDebian:14 | before 3.2.8-1, plus listed versions 3.0.4-33.0.4-43.0.4-53.0.4-63.0.4-6.1 Show 15 moreShow less3.0.4-6.23.0.6-13.2.0-13.2.0~RC2-13.2.0~RC2-23.2.0~RC2-33.2.0~RC2-3.13.2.0~RC2-3.23.2.0~RC2-3.33.2.0~RC3-13.2.2-13.2.4-13.2.4-23.2.4-33.2.6-1 | 3.2.8-1 |
gimpRed Hat:enterprise_linux:9::appstream From an advisory covering 5 CVEs | before 2:3.0.4-4.el9_8.15 | 2:3.0.4-4.el9_8.15 |
gimp-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 5 CVEs | before 2:3.0.4-4.el9_8.15 | 2:3.0.4-4.el9_8.15 |
gimp-debugsourceRed Hat:enterprise_linux:9::appstream From an advisory covering 5 CVEs | before 2:3.0.4-4.el9_8.15 | 2:3.0.4-4.el9_8.15 |
gimp-devel-tools-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 5 CVEs | before 2:3.0.4-4.el9_8.15 | 2:3.0.4-4.el9_8.15 |
gimp-libsRed Hat:enterprise_linux:9::appstream From an advisory covering 5 CVEs | before 2:3.0.4-4.el9_8.15 | 2:3.0.4-4.el9_8.15 |
gimp-libs-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 5 CVEs | before 2:3.0.4-4.el9_8.15 | 2:3.0.4-4.el9_8.15 |
gimpRed Hat:enterprise_linux:8::appstream | before 2:2.8.22-26.module+el8.10.0+25170+1f1aa845.10 | 2:2.8.22-26.module+el8.10.0+25170+1f1aa845.10 |
gimp-debuginfoRed Hat:enterprise_linux:8::appstream | before 2:2.8.22-26.module+el8.10.0+25170+1f1aa845.10 | 2:2.8.22-26.module+el8.10.0+25170+1f1aa845.10 |
gimp-debugsourceRed Hat:enterprise_linux:8::appstream | before 2:2.8.22-26.module+el8.10.0+25170+1f1aa845.10 | 2:2.8.22-26.module+el8.10.0+25170+1f1aa845.10 |
gimp-develRed Hat:enterprise_linux:8::appstream | before 2:2.8.22-26.module+el8.10.0+25170+1f1aa845.10 | 2:2.8.22-26.module+el8.10.0+25170+1f1aa845.10 |
gimp-devel-toolsRed Hat:enterprise_linux:8::appstream | before 2:2.8.22-26.module+el8.10.0+25170+1f1aa845.10 | 2:2.8.22-26.module+el8.10.0+25170+1f1aa845.10 |
gimp-devel-tools-debuginfoRed Hat:enterprise_linux:8::appstream | before 2:2.8.22-26.module+el8.10.0+25170+1f1aa845.10 | 2:2.8.22-26.module+el8.10.0+25170+1f1aa845.10 |
gimp-libsRed Hat:enterprise_linux:8::appstream | before 2:2.8.22-26.module+el8.10.0+25170+1f1aa845.10 | 2:2.8.22-26.module+el8.10.0+25170+1f1aa845.10 |
gimp-libs-debuginfoRed Hat:enterprise_linux:8::appstream | before 2:2.8.22-26.module+el8.10.0+25170+1f1aa845.10 | 2:2.8.22-26.module+el8.10.0+25170+1f1aa845.10 |
pygobject2Red Hat:enterprise_linux:8::appstream | before 0:2.28.7-5.module+el8.10.0+22676+becd68d6 | 0:2.28.7-5.module+el8.10.0+22676+becd68d6 |
pygobject2-codegenRed Hat:enterprise_linux:8::appstream | before 0:2.28.7-5.module+el8.10.0+22676+becd68d6 | 0:2.28.7-5.module+el8.10.0+22676+becd68d6 |
pygobject2-debuginfoRed Hat:enterprise_linux:8::appstream | before 0:2.28.7-5.module+el8.10.0+22676+becd68d6 | 0:2.28.7-5.module+el8.10.0+22676+becd68d6 |
pygobject2-debugsourceRed Hat:enterprise_linux:8::appstream | before 0:2.28.7-5.module+el8.10.0+22676+becd68d6 | 0:2.28.7-5.module+el8.10.0+22676+becd68d6 |
pygobject2-develRed Hat:enterprise_linux:8::appstream | before 0:2.28.7-5.module+el8.10.0+22676+becd68d6 | 0:2.28.7-5.module+el8.10.0+22676+becd68d6 |
pygobject2-docRed Hat:enterprise_linux:8::appstream | before 0:2.28.7-5.module+el8.10.0+22676+becd68d6 | 0:2.28.7-5.module+el8.10.0+22676+becd68d6 |
pygtk2Red Hat:enterprise_linux:8::appstream | before 0:2.24.0-25.module+el8.9.0+21228+8e80d31d | 0:2.24.0-25.module+el8.9.0+21228+8e80d31d |
pygtk2-codegenRed Hat:enterprise_linux:8::appstream | before 0:2.24.0-25.module+el8.9.0+21228+8e80d31d | 0:2.24.0-25.module+el8.9.0+21228+8e80d31d |
pygtk2-debuginfoRed Hat:enterprise_linux:8::appstream | before 0:2.24.0-25.module+el8.9.0+21228+8e80d31d | 0:2.24.0-25.module+el8.9.0+21228+8e80d31d |
pygtk2-debugsourceRed Hat:enterprise_linux:8::appstream | before 0:2.24.0-25.module+el8.9.0+21228+8e80d31d | 0:2.24.0-25.module+el8.9.0+21228+8e80d31d |
pygtk2-develRed Hat:enterprise_linux:8::appstream | before 0:2.24.0-25.module+el8.9.0+21228+8e80d31d | 0:2.24.0-25.module+el8.9.0+21228+8e80d31d |
pygtk2-docRed Hat:enterprise_linux:8::appstream | before 0:2.24.0-25.module+el8.9.0+21228+8e80d31d | 0:2.24.0-25.module+el8.9.0+21228+8e80d31d |
python2-cairoRed Hat:enterprise_linux:8::appstream | before 0:1.16.3-7.module+el8.10.0+22676+becd68d6 | 0:1.16.3-7.module+el8.10.0+22676+becd68d6 |
python2-cairo-debuginfoRed Hat:enterprise_linux:8::appstream | before 0:1.16.3-7.module+el8.10.0+22676+becd68d6 | 0:1.16.3-7.module+el8.10.0+22676+becd68d6 |
python2-cairo-develRed Hat:enterprise_linux:8::appstream | before 0:1.16.3-7.module+el8.10.0+22676+becd68d6 | 0:1.16.3-7.module+el8.10.0+22676+becd68d6 |
python2-pycairoRed Hat:enterprise_linux:8::appstream | before 0:1.16.3-7.module+el8.10.0+22676+becd68d6 | 0:1.16.3-7.module+el8.10.0+22676+becd68d6 |
python2-pycairo-debugsourceRed Hat:enterprise_linux:8::appstream | before 0:1.16.3-7.module+el8.10.0+22676+becd68d6 | 0:1.16.3-7.module+el8.10.0+22676+becd68d6 |
gimpRed Hat:enterprise_linux:9::appstream From an advisory covering 5 CVEs | before 2:3.0.4-8.el9_9.5 | 2:3.0.4-8.el9_9.5 |
gimp-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 5 CVEs | before 2:3.0.4-8.el9_9.5 | 2:3.0.4-8.el9_9.5 |
gimp-debugsourceRed Hat:enterprise_linux:9::appstream From an advisory covering 5 CVEs | before 2:3.0.4-8.el9_9.5 | 2:3.0.4-8.el9_9.5 |
gimp-devel-tools-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 5 CVEs | before 2:3.0.4-8.el9_9.5 | 2:3.0.4-8.el9_9.5 |
gimp-libsRed Hat:enterprise_linux:9::appstream From an advisory covering 5 CVEs | before 2:3.0.4-8.el9_9.5 | 2:3.0.4-8.el9_9.5 |
gimp-libs-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 5 CVEs | before 2:3.0.4-8.el9_9.5 | 2:3.0.4-8.el9_9.5 |
gimpRocky Linux:8 | before 2:2.8.22-26.module+el8.10.0+1927+52edb5a0 | 2:2.8.22-26.module+el8.10.0+1927+52edb5a0 |
gimpRocky Linux:8 | before 2:2.8.22-26.module+el8.10.0+1998+a08ccc48.2 | 2:2.8.22-26.module+el8.10.0+1998+a08ccc48.2 |
gimpRocky Linux:8 | before 2:2.8.22-26.module+el8.10.0+40134+eab491b1.5 | 2:2.8.22-26.module+el8.10.0+40134+eab491b1.5 |
gimpRocky Linux:8 | before 2:2.8.22-26.module+el8.10.0+40407+12f45184.10 | 2:2.8.22-26.module+el8.10.0+40407+12f45184.10 |
gimpRocky Linux:8 | before 2:2.8.22-26.module+el8.10.0+40308+ebf9d253.8 | 2:2.8.22-26.module+el8.10.0+40308+ebf9d253.8 |
gimpRocky Linux:8 | before 2:2.8.22-26.module+el8.10.0+40033+6fd27379.3 | 2:2.8.22-26.module+el8.10.0+40033+6fd27379.3 |
gimpRocky Linux:8 | before 2:2.8.22-26.module+el8.10.0+40181+ad0e3a65.6 | 2:2.8.22-26.module+el8.10.0+40181+ad0e3a65.6 |
gimpRocky Linux:8 | before 2:2.8.22-26.module+el8.10.0+40075+a21479b4.4 | 2:2.8.22-26.module+el8.10.0+40075+a21479b4.4 |
gimpRocky Linux:8 | before 2:2.8.22-26.module+el8.10.0+40380+6ffe857b.9 | 2:2.8.22-26.module+el8.10.0+40380+6ffe857b.9 |
pygobject2Rocky Linux:8 | before 0:2.28.7-5.module+el8.10.0+1927+52edb5a0 | 0:2.28.7-5.module+el8.10.0+1927+52edb5a0 |
pygtk2Rocky Linux:8 | before 0:2.24.0-25.module+el8.9.0+1723+9bc93544 | 0:2.24.0-25.module+el8.9.0+1723+9bc93544 |
python2-pycairoRocky Linux:8 | before 0:1.16.3-7.module+el8.10.0+1927+52edb5a0 | 0:1.16.3-7.module+el8.10.0+1927+52edb5a0 |
gimpUbuntu:Pro:16.04:LTS | All versions, plus listed versions 2.8.14-1ubuntu22.8.14-1.2ubuntu12.8.16-1ubuntu12.8.16-1ubuntu1.12.8.16-1ubuntu1.1+esm12.8.16-1ubuntu1.1+esm22.8.16-1ubuntu1.1+esm3 | None known |
gimpUbuntu:Pro:18.04:LTS | All versions, plus listed versions 2.8.20-12.8.20-1.12.8.20-22.8.22-12.8.22-1ubuntu0.1~esm12.8.22-1ubuntu0.1~esm22.8.22-1ubuntu0.1~esm3 | None known |
gimpUbuntu:Pro:20.04:LTS | All versions, plus listed versions 2.10.8-22.10.14-22.10.14-2build12.10.14-2ubuntu12.10.14-3 Show 5 moreShow less2.10.18-12.10.18-1ubuntu0.12.10.18-1ubuntu0.1+esm12.10.18-1ubuntu0.1+esm22.10.18-1ubuntu0.1+esm3 | None known |
gimpUbuntu:Pro:22.04:LTS | All versions, plus listed versions 2.10.24-22.10.28-12.10.30-12.10.30-1build12.10.30-1ubuntu0.12.10.30-1ubuntu0.1+esm12.10.30-1ubuntu0.1+esm22.10.30-1ubuntu0.1+esm3 | None known |
gimpUbuntu:Pro:24.04:LTS | All versions, plus listed versions 2.10.34-12.10.36-12.10.36-22.10.36-3build22.10.36-3build3 Show 4 moreShow less2.10.36-3ubuntu0.24.04.12.10.36-3ubuntu0.24.04.1+esm12.10.36-3ubuntu0.24.04.1+esm22.10.36-3ubuntu0.24.04.1+esm3 | None known |
gimpUbuntu:26.10 | All versions, plus listed versions 3.2.2-13.2.4-13.2.4-23.2.4-33.2.6-1 | None known |
gimpUbuntu:26.04:LTS | All versions, plus listed versions 3.0.4-6.13.0.4-6.23.0.6-13.2.0~RC2-23.2.0~RC2-3 Show 7 moreShow less3.2.0~RC2-3.13.2.0~RC2-3.23.2.0~RC2-3.33.2.0~RC3-13.2.0-13.2.2-13.2.2-1ubuntu0.26.04.1 | None known |
What each source reports
CVE List Score used
Gimp: gimp: heap out-of-bounds read/write in psd thumbnail loader (load_resource_1033)
A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially arbitrary code execution when the victim browses or opens the file.
- Record
CVE-2026-112257- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-121
- Updated
- 2026-11-11
EUVDEUVD-2026-104651
A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially arbitrary code execution when the victim browses or opens the file.
- Record
EUVD-2026-104651- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-11
GitHub AdvisoriesGHSA-cch8-wx4h-hxqr
A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap...
A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially arbitrary code execution when the victim browses or opens the file.
- Record
GHSA-cch8-wx4h-hxqr- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-121
- Updated
- 2026-11-11
NVD
A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially arbitrary code execution when the victim browses or opens the file.
- Record
CVE-2026-112257- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-121
- Updated
- 2026-11-11
OSVDEBIAN-CVE-2026-112257
A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially arbitrary code execution when the victim browses or opens the file.
- Record
DEBIAN-CVE-2026-112257- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-08
OSVRHSA-2026:93975
Red Hat Security Advisory: gimp security update
- Record
RHSA-2026:93975- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-13
Show 6 moreShow less
OSVRHSA-2026:95482
Red Hat Security Advisory: gimp:2.8 security, bug fix, and enhancement update
- Record
RHSA-2026:95482- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-13
OSVRHSA-2026:98495
Red Hat Security Advisory: gimp security update
- Record
RHSA-2026:98495- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-13
OSVRLSA-2026:95482
Important: gimp:2.8 security, bug fix, and enhancement update
The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.
Security Fix(es):
- gimp: gimp: heap out-of-bounds read/write in PSD thumbnail loader (load_resource_1033) (CVE-2026-112257)
Bug Fix(es) and Enhancement(s):
- gimp: xpm poc file for CVE-2026-4154 should error differently (JIRA:Rocky Linux-178367)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:95482- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-06
OSVUBUNTU-CVE-2026-112257
A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially arbitrary code execution when the victim browses or opens the file.
- Record
UBUNTU-CVE-2026-112257- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVALSA-2026:93975No score
Important: gimp security update
The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.
Security Fix(es):
- gimp: GIMP: heap buffer overflow in DDS loader on crafted DirectDraw Surface file (CVE-2026-106062)
- gimp: gimp: heap out-of-bounds read/write in PSD thumbnail loader (load_resource_1033) (CVE-2026-112257)
- gimp: gimp: use-after-free in XCF loader via PROP_LINKED and PROP_SELECTION on channels (CVE-2026-112258)
- gimp: gimp: heap out-of-bounds read in XCF text-layer parasite parsing (CVE-2026-112260)
- gimp: gimp: use-after-free in XCF loader via PROP_SELECTED_PATH (CVE-2026-112261)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:93975- Updated
- 2026-11-04
OSVALSA-2026:95482No score
Important: gimp:2.8 security, bug fix, and enhancement update
The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.
Security Fix(es):
- gimp: gimp: heap out-of-bounds read/write in PSD thumbnail loader (load_resource_1033) (CVE-2026-112257)
Bug Fix(es) and Enhancement(s):
- gimp: xpm poc file for CVE-2026-4154 should error differently (JIRA:RHEL-178367)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:95482- Updated
- 2026-11-05
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | EUVD, GitHub Advisories, NVD, OSV | |
| references | CVE List | |
| affected | OSV | |
| affected, aliases, facts, references | OSV | |
| affected, facts | ||
| affected, aliases, references | OSV | |
| references | CVE List, GitHub Advisories, NVD | |
| references | CVE List, EUVD, NVD | |
| affected, aliases, facts, references | EUVD, GitHub Advisories, NVD, OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
access.redhat.com/errata/RHSA-2026:93975
bugzilla.redhat.com/show_bug.cgi?id=2555574
nvd.nist.gov/vuln/detail/CVE-2026-112257
Show 34 moreShow less
github.com/advisories/GHSA-cch8-wx4h-hxqr
errata.almalinux.org/9/ALSA-2026-93975.html
security-tracker.debian.org/tracker/CVE-2026-112257
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_93975.json
cve.org/CVERecord?id=CVE-2026-106062
issues.redhat.com/browse/RHEL-178367
errata.rockylinux.org/RLSA-2026:95482
ubuntu.com/security/CVE-2026-112257
gitlab.gnome.org/GNOME/gimp/-/work_items/16862
Left out here: 8 versions. The JSON record has them.