CVE-2026-58381
Gimp: gimp: double-free in read_layer_block()
A flaw was found in GIMP's PSP file format parser. A double-free condition occurs in the read_layer_block() function when processing a specially crafted PSP file. This could allow an attacker to cause memory corruption, potentially leading to denial of service or arbitrary code execution.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Gimp: gimp: double-free in read_layer_block()
A flaw was found in GIMP's PSP file format parser. A double-free condition occurs in the read_layer_block() function when processing a specially crafted PSP file. This could allow an attacker to cause memory corruption, potentially leading to denial of service or arbitrary code execution.
- Record
CVE-2026-58381- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H - Weakness
- CWE-415
- Updated
- 2026-11-05
EUVDEUVD-2026-41434
A flaw was found in GIMP's PSP file format parser. A double-free condition occurs in the read_layer_block() function when processing a specially crafted PSP file. This could allow an attacker to cause memory corruption, potentially leading to denial of service or arbitrary code execution.
- Record
EUVD-2026-41434- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H - Updated
- 2026-11-05
GitHub AdvisoriesGHSA-pfjw-r4vx-pmfw
A flaw was found in GIMP's PSP file format parser. A double-free condition occurs in the...
A flaw was found in GIMP's PSP file format parser. A double-free condition occurs in the read_layer_block() function when processing a specially crafted PSP file. This could allow an attacker to cause memory corruption, potentially leading to denial of service or arbitrary code execution.
- Record
GHSA-pfjw-r4vx-pmfw- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H - Weakness
- CWE-415
- Updated
- 2026-11-02
NVD
A flaw was found in GIMP's PSP file format parser. A double-free condition occurs in the read_layer_block() function when processing a specially crafted PSP file. This could allow an attacker to cause memory corruption, potentially leading to denial of service or arbitrary code execution.
- Record
CVE-2026-58381- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H - CVSS 3.1
- 7.3 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-415
- Updated
- 2026-11-06
OSV
Gimp: gimp: double-free in read_layer_block()
A flaw was found in GIMP's PSP file format parser. A double-free condition occurs in the read_layer_block() function when processing a specially crafted PSP file. This could allow an attacker to cause memory corruption, potentially leading to denial of service or arbitrary code execution.
- Record
CVE-2026-58381- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H - Weakness
- CWE-415
- Updated
- 2026-11-07
OSVDEBIAN-CVE-2026-58381
A flaw was found in GIMP's PSP file format parser. A double-free condition occurs in the read_layer_block() function when processing a specially crafted PSP file. This could allow an attacker to cause memory corruption, potentially leading to denial of service or arbitrary code execution.
- Record
DEBIAN-CVE-2026-58381- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-06
Show 7 moreShow less
OSVOESA-2026-2880
gimp security update
The GIMP is an image composition and editing program, which can be used for creating logos and other graphics for Web pages. The GIMP offers many tools and filters, and provides a large image manipulation toolbox, including channel operations and layers, effects, subpixel imaging and antialiasing, and conversions, together with multilevel undo. The GIMP offers a scripting facility, but many of the included scripts rely on fonts that we cannot distribute.
Security Fix(es):
A flaw was found in GIMP's PSP file format parser. A double-free condition occurs in the read_layer_block() function when processing a specially crafted PSP file. This could allow an attacker to cause memory corruption, potentially leading to denial of service or arbitrary code execution.(CVE-2026-58381)
- Record
OESA-2026-2880- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H - Updated
- 2026-11-02
OSVOESA-2026-2882
gimp security update
The GIMP is an image composition and editing program, which can be used for creating logos and other graphics for Web pages. The GIMP offers many tools and filters, and provides a large image manipulation toolbox, including channel operations and layers, effects, subpixel imaging and antialiasing, and conversions, together with multilevel undo. The GIMP offers a scripting facility, but many of the included scripts rely on fonts that we cannot distribute.
Security Fix(es):
A flaw was found in GIMP's PSP file format parser. A double-free condition occurs in the read_layer_block() function when processing a specially crafted PSP file. This could allow an attacker to cause memory corruption, potentially leading to denial of service or arbitrary code execution.(CVE-2026-58381)
- Record
OESA-2026-2882- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-58381
A flaw was found in GIMP's PSP file format parser. A double-free condition occurs in the read_layer_block() function when processing a specially crafted PSP file. This could allow an attacker to cause memory corruption, potentially leading to denial of service or arbitrary code execution.
- Record
UBUNTU-CVE-2026-58381- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H - CVSS 3.1
- 7.3 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1791295129 No score
gimp: Fix of CVE-2026-58381
- CVE-2026-58381: reset the PSP layer name on each layer iteration to avoid a double free
- Record
CLSA-2026-1791295129- Updated
- 2026-11-02
OSVCLSA-2026-1791296305 No score
gimp: Fix of 2 CVEs
- CVE-2026-58381: reset the PSP layer name on each layer iteration to avoid a double free
- Record
CLSA-2026-1791296305- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:21359-1 No score
Security update for gimp
This update for gimp fixes the following issues:
Changes in gimp:
- CVE-2026-58379: Fix PSP File Parsing Heap Buffer Overflow (bsc#1270299)
- CVE-2026-58380: Fix buffer overflow in pnmscanner_gettoken (bsc#1270444)
- CVE-2026-58381: Prevent double-freeing PSP layer name (bsc#1270239)
- Record
openSUSE-SU-2026:21359-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:3399-1 No score
Security update for gimp
This update for gimp fixes the following issues
- CVE-2026-58379: Heap buffer overflow in read_channel_data() (bsc#1270299).
- CVE-2026-58380: Stack buffer overflow in pnmscanner_gettoken() (bsc#1270444).
- CVE-2026-58381: double-free in read_layer_block() (bsc#1270239).
- Record
SUSE-SU-2026:3399-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gimpTuxCare:AlmaLinux:9.2 |
before 2:2.99.8-4.el9.2.tuxcare.els21 | 2:2.99.8-4.el9.2.tuxcare.els21 |
gimp-develTuxCare:AlmaLinux:9.2 |
before 2:2.99.8-4.el9.2.tuxcare.els21 | 2:2.99.8-4.el9.2.tuxcare.els21 |
gimp-devel-toolsTuxCare:AlmaLinux:9.2 |
before 2:2.99.8-4.el9.2.tuxcare.els21 | 2:2.99.8-4.el9.2.tuxcare.els21 |
gimp-libsTuxCare:AlmaLinux:9.2 |
before 2:2.99.8-4.el9.2.tuxcare.els21 | 2:2.99.8-4.el9.2.tuxcare.els21 |
gimpTuxCare:AlmaLinux:9.6 |
before 2:2.99.8-4.el9_6.2.tuxcare.els21 | 2:2.99.8-4.el9_6.2.tuxcare.els21 |
gimp-develTuxCare:AlmaLinux:9.6 |
before 2:2.99.8-4.el9_6.2.tuxcare.els21 | 2:2.99.8-4.el9_6.2.tuxcare.els21 |
gimp-devel-toolsTuxCare:AlmaLinux:9.6 |
before 2:2.99.8-4.el9_6.2.tuxcare.els21 | 2:2.99.8-4.el9_6.2.tuxcare.els21 |
gimp-libsTuxCare:AlmaLinux:9.6 |
before 2:2.99.8-4.el9_6.2.tuxcare.els21 | 2:2.99.8-4.el9_6.2.tuxcare.els21 |
gimpDebian:12 |
All versions, plus listed versions 2.10.34-12.10.34-1+deb12u12.10.34-1+deb12u102.10.34-1+deb12u22.10.34-1+deb12u3 Show 45 moreShow less2.10.34-1+deb12u42.10.34-1+deb12u52.10.34-1+deb12u62.10.34-1+deb12u72.10.34-1+deb12u82.10.34-1+deb12u92.10.36-12.10.36-22.10.36-32.10.38-12.10.38-22.99.10-12.99.12-12.99.12-22.99.14-12.99.14-22.99.16-12.99.16-22.99.18-13.0.0-13.0.0-23.0.0~RC1-13.0.0~RC1-33.0.0~RC1-43.0.0~RC2-13.0.0~RC3-13.0.2-13.0.2-23.0.2-33.0.2-3.13.0.4-13.0.4-23.0.4-33.0.4-43.0.4-53.0.4-63.0.4-6.13.0.4-6.23.0.6-13.2.0-13.2.0~RC2-13.2.0~RC2-23.2.0~RC2-33.2.0~RC2-3.13.2.0~RC2-3.2 |
None known |
gimpDebian:13 |
before 3.0.4-3+deb13u10, plus listed versions 3.0.4-33.0.4-3+deb13u13.0.4-3+deb13u23.0.4-3+deb13u33.0.4-3+deb13u4 Show 5 moreShow less3.0.4-3+deb13u53.0.4-3+deb13u63.0.4-3+deb13u73.0.4-3+deb13u83.0.4-3+deb13u9 |
3.0.4-3+deb13u10 |
Show 13 moreShow less
| Package | Affected | Fixed |
|---|---|---|
gimpDebian:14 |
before 3.2.4-1, plus listed versions 3.0.4-33.0.4-43.0.4-53.0.4-63.0.4-6.1 Show 11 moreShow less3.0.4-6.23.0.6-13.2.0-13.2.0~RC2-13.2.0~RC2-23.2.0~RC2-33.2.0~RC2-3.13.2.0~RC2-3.23.2.0~RC2-3.33.2.0~RC3-13.2.2-1 |
3.2.4-1 |
gimpopenEuler:24.03-LTS-SP3 |
before 3.0.2-15.oe2403sp3 | 3.0.2-15.oe2403sp3 |
gimpopenEuler:24.03-LTS-SP1 |
before 3.0.2-15.oe2403sp1 | 3.0.2-15.oe2403sp1 |
gimpSUSE:Linux Enterprise Module for Package Hub 15 SP7 From an advisory covering 3 CVEs |
before 2.10.30-150400.3.58.1 | 2.10.30-150400.3.58.1 |
gimpSUSE:Linux Enterprise Workstation Extension 15 SP7 From an advisory covering 3 CVEs |
before 2.10.30-150400.3.58.1 | 2.10.30-150400.3.58.1 |
gimpUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.8.14-1ubuntu22.8.14-1.2ubuntu12.8.16-1ubuntu12.8.16-1ubuntu1.12.8.16-1ubuntu1.1+esm12.8.16-1ubuntu1.1+esm22.8.16-1ubuntu1.1+esm3 |
None known |
gimpUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.8.20-12.8.20-1.12.8.20-22.8.22-12.8.22-1ubuntu0.1~esm12.8.22-1ubuntu0.1~esm22.8.22-1ubuntu0.1~esm3 |
None known |
gimpUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2.10.8-22.10.14-22.10.14-2build12.10.14-2ubuntu12.10.14-3 Show 5 moreShow less2.10.18-12.10.18-1ubuntu0.12.10.18-1ubuntu0.1+esm12.10.18-1ubuntu0.1+esm22.10.18-1ubuntu0.1+esm3 |
None known |
gimpUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 2.10.24-22.10.28-12.10.30-12.10.30-1build12.10.30-1ubuntu0.12.10.30-1ubuntu0.1+esm12.10.30-1ubuntu0.1+esm22.10.30-1ubuntu0.1+esm3 |
None known |
gimpUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 2.10.34-12.10.36-12.10.36-22.10.36-3build22.10.36-3build3 Show 4 moreShow less2.10.36-3ubuntu0.24.04.12.10.36-3ubuntu0.24.04.1+esm12.10.36-3ubuntu0.24.04.1+esm22.10.36-3ubuntu0.24.04.1+esm3 |
None known |
gimpUbuntu:25.10 |
All versions, plus listed versions 3.0.2-13.0.2-23.0.2-33.0.2-3.13.0.4-1 Show 5 moreShow less3.0.4-23.0.4-33.0.4-53.0.4-63.0.4-6.1 |
None known |
gimpUbuntu:26.04:LTS |
All versions, plus listed versions 3.0.4-6.13.0.4-6.23.0.6-13.2.0~RC2-23.2.0~RC2-3 Show 7 moreShow less3.2.0~RC2-3.13.2.0~RC2-3.23.2.0~RC2-3.33.2.0~RC3-13.2.0-13.2.2-13.2.2-1ubuntu0.26.04.1 |
None known |
gimpopenSUSE:Leap 16.0 From an advisory covering 3 CVEs |
before 3.0.8-bp160.5.1 | 3.0.8-bp160.5.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | OSV | |
| affected | ||
| references | CVE List, NVD | |
| facts | EUVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-58381 is a medium vulnerability (CVSS 6.1) in Gimp, published July 2, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.29%, the 21st percentile. Fixed in gimp 2:2.99.8-4.el9.2.tuxcare.els21.
References
access.redhat.com/security/cve/CVE-2026-58381
bugzilla.redhat.com/show_bug.cgi?id=2496166
gitlab.gnome.org/GNOME/gimp/-/commit/b22e147b
nvd.nist.gov/vuln/detail/CVE-2026-58381
github.com/advisories/GHSA-pfjw-r4vx-pmfw
Show 18 moreShow less
errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1791295129.html
security-tracker.debian.org/tracker/CVE-2026-58381
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-2880
suse.com/support/update/announcement/2026/suse-su-20263399-1
bugzilla.suse.com/1270239
ubuntu.com/security/CVE-2026-58381
cve.org/CVERecord?id=CVE-2026-58381
Left out here: 8 versions. The JSON record has them.