{"id":"CVE-2026-112257","aliases":["ALSA-2026:93975","ALSA-2026:95482","DEBIAN-CVE-2026-112257","EUVD-2026-104651","GHSA-cch8-wx4h-hxqr","RLSA-2026:95482","UBUNTU-CVE-2026-112257"],"status":"published","title":"Gimp: gimp: heap out-of-bounds read/write in psd thumbnail loader (load_resource_1033)","description":"A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially arbitrary code execution when the victim browses or opens the file.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00175,"percentile":0.07082,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-121"],"published":"2026-10-19T21:37:19Z","modified":"2026-11-11T12:07:08Z","fixes":[{"ecosystem":"Debian:14","package":"gimp","fixed_in":["3.2.8-1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"gimp","fixed_in":["2:2.8.22-26.module+el8.10.0+1927+52edb5a0","2:2.8.22-26.module+el8.10.0+1998+a08ccc48.2","2:2.8.22-26.module+el8.10.0+40134+eab491b1.5","2:2.8.22-26.module+el8.10.0+40407+12f45184.10","2:2.8.22-26.module+el8.10.0+40308+ebf9d253.8","2:2.8.22-26.module+el8.10.0+40033+6fd27379.3","2:2.8.22-26.module+el8.10.0+40181+ad0e3a65.6","2:2.8.22-26.module+el8.10.0+40075+a21479b4.4","2:2.8.22-26.module+el8.10.0+40380+6ffe857b.9"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"pygobject2","fixed_in":["0:2.28.7-5.module+el8.10.0+1927+52edb5a0"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"pygtk2","fixed_in":["0:2.24.0-25.module+el8.9.0+1723+9bc93544"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"python2-pycairo","fixed_in":["0:1.16.3-7.module+el8.10.0+1927+52edb5a0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.0.4-4.el9_8.15"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"gimp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.0.4-4.el9_8.15"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.8.22-26.module_el8.10.0+4352+8516153e.10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"gimp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.8.22-26.module_el8.10.0+4352+8516153e.10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"gimp-devel-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.8.22-26.module_el8.10.0+4352+8516153e.10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"gimp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.8.22-26.module_el8.10.0+4352+8516153e.10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"pygobject2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.28.7-5.module_el8.10.0+4267+35168c80"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"pygobject2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.28.7-5.module_el8.10.0+4175+c208a0bf"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"pygobject2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.28.7-5.module_el8.10.0+4137+2d0d25cf"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"pygobject2-codegen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.28.7-5.module_el8.10.0+4267+35168c80"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"pygobject2-codegen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.28.7-5.module_el8.10.0+4175+c208a0bf"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"pygobject2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.28.7-5.module_el8.10.0+4267+35168c80"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"pygobject2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.28.7-5.module_el8.10.0+4137+2d0d25cf"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"pygobject2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.28.7-5.module_el8.10.0+3952+571e801c"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"pygobject2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.28.7-5.module_el8.10.0+4267+35168c80"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"pygobject2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.28.7-5.module_el8.10.0+4137+2d0d25cf"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"pygtk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.24.0-25.module_el8.9.0+3725+d1441900"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"pygtk2-codegen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.24.0-25.module_el8.9.0+3725+d1441900"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"pygtk2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.24.0-25.module_el8.9.0+3725+d1441900"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"pygtk2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.24.0-25.module_el8.9.0+3725+d1441900"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"python2-cairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-7.module_el8.10.0+4267+35168c80"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"python2-cairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-7.module_el8.10.0+4175+c208a0bf"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"python2-cairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-7.module_el8.10.0+3952+571e801c"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"python2-cairo-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-7.module_el8.10.0+4267+35168c80"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"python2-cairo-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-7.module_el8.10.0+4175+c208a0bf"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.10.34-1","2.10.34-1+deb12u1","2.10.34-1+deb12u10","2.10.34-1+deb12u2","2.10.34-1+deb12u3","2.10.34-1+deb12u4","2.10.34-1+deb12u5","2.10.34-1+deb12u6","2.10.34-1+deb12u7","2.10.34-1+deb12u8","2.10.34-1+deb12u9","2.10.36-1","2.10.36-2","2.10.36-3","2.10.38-1","2.10.38-2","2.99.10-1","2.99.12-1","2.99.12-2","2.99.14-1","2.99.14-2","2.99.16-1","2.99.16-2","2.99.18-1","3.0.0-1","3.0.0-2","3.0.0~RC1-1","3.0.0~RC1-3","3.0.0~RC1-4","3.0.0~RC2-1","3.0.0~RC3-1","3.0.2-1","3.0.2-2","3.0.2-3","3.0.2-3.1","3.0.4-1","3.0.4-2","3.0.4-3","3.0.4-4","3.0.4-5","3.0.4-6","3.0.4-6.1","3.0.4-6.2","3.0.6-1","3.2.0-1","3.2.0~RC2-1","3.2.0~RC2-2","3.2.0~RC2-3","3.2.0~RC2-3.1","3.2.0~RC2-3.2","3.2.0~RC2-3.3","3.2.0~RC3-1","3.2.2-1","3.2.4-1","3.2.4-2","3.2.4-3","3.2.6-1","3.2.8-1"]},{"source":"osv","ecosystem":"Debian:13","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.4-3","3.0.4-3+deb13u1","3.0.4-3+deb13u10","3.0.4-3+deb13u11","3.0.4-3+deb13u2","3.0.4-3+deb13u3","3.0.4-3+deb13u4","3.0.4-3+deb13u5","3.0.4-3+deb13u6","3.0.4-3+deb13u7","3.0.4-3+deb13u8","3.0.4-3+deb13u9","3.0.4-4","3.0.4-5","3.0.4-6","3.0.4-6.1","3.0.4-6.2","3.0.6-1","3.2.0-1","3.2.0~RC2-1","3.2.0~RC2-2","3.2.0~RC2-3","3.2.0~RC2-3.1","3.2.0~RC2-3.2","3.2.0~RC2-3.3","3.2.0~RC3-1","3.2.2-1","3.2.4-1","3.2.4-2","3.2.4-3","3.2.6-1","3.2.8-1"]},{"source":"osv","ecosystem":"Debian:14","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.8-1"}]}],"versions":["3.0.4-3","3.0.4-4","3.0.4-5","3.0.4-6","3.0.4-6.1","3.0.4-6.2","3.0.6-1","3.2.0-1","3.2.0~RC2-1","3.2.0~RC2-2","3.2.0~RC2-3","3.2.0~RC2-3.1","3.2.0~RC2-3.2","3.2.0~RC2-3.3","3.2.0~RC3-1","3.2.2-1","3.2.4-1","3.2.4-2","3.2.4-3","3.2.6-1"]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.8.22-26.module+el8.10.0+1927+52edb5a0"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.8.22-26.module+el8.10.0+1998+a08ccc48.2"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.8.22-26.module+el8.10.0+40134+eab491b1.5"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.8.22-26.module+el8.10.0+40407+12f45184.10"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.8.22-26.module+el8.10.0+40308+ebf9d253.8"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.8.22-26.module+el8.10.0+40033+6fd27379.3"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.8.22-26.module+el8.10.0+40181+ad0e3a65.6"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.8.22-26.module+el8.10.0+40075+a21479b4.4"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.8.22-26.module+el8.10.0+40380+6ffe857b.9"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"pygobject2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.28.7-5.module+el8.10.0+1927+52edb5a0"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"pygtk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.24.0-25.module+el8.9.0+1723+9bc93544"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"python2-pycairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.3-7.module+el8.10.0+1927+52edb5a0"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.14-1ubuntu2","2.8.14-1.2ubuntu1","2.8.16-1ubuntu1","2.8.16-1ubuntu1.1","2.8.16-1ubuntu1.1+esm1","2.8.16-1ubuntu1.1+esm2","2.8.16-1ubuntu1.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.20-1","2.8.20-1.1","2.8.20-2","2.8.22-1","2.8.22-1ubuntu0.1~esm1","2.8.22-1ubuntu0.1~esm2","2.8.22-1ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.10.8-2","2.10.14-2","2.10.14-2build1","2.10.14-2ubuntu1","2.10.14-3","2.10.18-1","2.10.18-1ubuntu0.1","2.10.18-1ubuntu0.1+esm1","2.10.18-1ubuntu0.1+esm2","2.10.18-1ubuntu0.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.10.24-2","2.10.28-1","2.10.30-1","2.10.30-1build1","2.10.30-1ubuntu0.1","2.10.30-1ubuntu0.1+esm1","2.10.30-1ubuntu0.1+esm2","2.10.30-1ubuntu0.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.10.34-1","2.10.36-1","2.10.36-2","2.10.36-3build2","2.10.36-3build3","2.10.36-3ubuntu0.24.04.1","2.10.36-3ubuntu0.24.04.1+esm1","2.10.36-3ubuntu0.24.04.1+esm2","2.10.36-3ubuntu0.24.04.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.2-1","3.2.4-1","3.2.4-2","3.2.4-3","3.2.6-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.4-6.1","3.0.4-6.2","3.0.6-1","3.2.0~RC2-2","3.2.0~RC2-3","3.2.0~RC2-3.1","3.2.0~RC2-3.2","3.2.0~RC2-3.3","3.2.0~RC3-1","3.2.0-1","3.2.2-1","3.2.2-1ubuntu0.26.04.1"]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:93975","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:95482","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:98495","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-112257","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2555574","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112257"},{"url":"https://github.com/advisories/GHSA-cch8-wx4h-hxqr"},{"url":"https://access.redhat.com/security/cve/CVE-2026-106062","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-112258","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-112260","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-112261","tags":["report"]},{"url":"https://bugzilla.redhat.com/2546654","tags":["report"]},{"url":"https://bugzilla.redhat.com/2555574","tags":["report"]},{"url":"https://bugzilla.redhat.com/2555588","tags":["report"]},{"url":"https://bugzilla.redhat.com/2555730","tags":["report"]},{"url":"https://bugzilla.redhat.com/2555748","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-93975.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-95482.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-112257","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:95482","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-112257","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-112257","tags":["report"]},{"url":"https://gitlab.gnome.org/GNOME/gimp/-/work_items/16862","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-112257","title":"Gimp: gimp: heap out-of-bounds read/write in psd thumbnail loader (load_resource_1033)","description":"A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially arbitrary code execution when the victim browses or opens the file.","status":"published","published":"2026-10-19T21:37:19.467Z","modified":"2026-11-11T12:07:08.371Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-121"],"updated_at":"2026-11-11T13:28:04.456673Z"}],"euvd":[{"id":"EUVD-2026-104651","description":"A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially arbitrary code execution when the victim browses or opens the file.","status":"published","published":"2026-10-19T21:37:19Z","modified":"2026-11-11T12:07:08Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-11T13:28:41.983834Z"}],"ghsa":[{"id":"GHSA-cch8-wx4h-hxqr","title":"A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap...","description":"A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially arbitrary code execution when the victim browses or opens the file.","status":"published","published":"2026-10-20T00:31:57Z","modified":"2026-11-11T15:31:54Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-121"],"updated_at":"2026-11-11T15:34:48.112751Z"}],"nvd":[{"id":"CVE-2026-112257","description":"A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially arbitrary code execution when the victim browses or opens the file.","status":"published","published":"2026-10-19T22:17:05.42Z","modified":"2026-11-11T13:17:14.03Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-121"],"updated_at":"2026-11-11T15:25:15.389278Z"}],"osv":[{"id":"DEBIAN-CVE-2026-112257","description":"A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially arbitrary code execution when the victim browses or opens the file.","status":"published","published":"2026-10-19T22:17:05.42Z","modified":"2026-11-12T09:47:40.210046113Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-08T22:11:41.975705Z"},{"id":"RLSA-2026:95482","title":"Important: gimp:2.8 security, bug fix, and enhancement update","description":"The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.\n\nSecurity Fix(es):\n\n* gimp: gimp: heap out-of-bounds read/write in PSD thumbnail loader (load_resource_1033) (CVE-2026-112257)\n\nBug Fix(es) and Enhancement(s):\n\n* gimp: xpm poc file for CVE-2026-4154 should error differently (JIRA:Rocky Linux-178367)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-06T12:01:27.250698Z","modified":"2026-11-06T12:30:02.698187857Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-06T12:43:06.926783Z"},{"id":"UBUNTU-CVE-2026-112257","description":"A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially arbitrary code execution when the victim browses or opens the file.","status":"published","published":"2026-10-19T22:17:00Z","modified":"2026-10-28T20:17:43.150314933Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:59.591851Z"},{"id":"ALSA-2026:93975","title":"Important: gimp security update","description":"The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.  \n\nSecurity Fix(es):  \n\n  * gimp: GIMP: heap buffer overflow in DDS loader on crafted DirectDraw Surface file (CVE-2026-106062)\n  * gimp: gimp: heap out-of-bounds read/write in PSD thumbnail loader (load_resource_1033) (CVE-2026-112257)\n  * gimp: gimp: use-after-free in XCF loader via PROP_LINKED and PROP_SELECTION on channels (CVE-2026-112258)\n  * gimp: gimp: heap out-of-bounds read in XCF text-layer parasite parsing (CVE-2026-112260)\n  * gimp: gimp: use-after-free in XCF loader via PROP_SELECTED_PATH (CVE-2026-112261)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-11-02T00:00:00Z","modified":"2026-11-04T16:45:03.664201969Z","updated_at":"2026-11-04T17:11:08.071099Z"},{"id":"ALSA-2026:95482","title":"Important: gimp:2.8 security, bug fix, and enhancement update","description":"The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.  \n\nSecurity Fix(es):  \n\n  * gimp: gimp: heap out-of-bounds read/write in PSD thumbnail loader (load_resource_1033) (CVE-2026-112257)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * gimp: xpm poc file for CVE-2026-4154 should error differently (JIRA:RHEL-178367)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-11-05T00:00:00Z","modified":"2026-11-05T12:15:03.893254549Z","updated_at":"2026-11-05T13:30:00.949926Z"}]}}