{"id":"CVE-2026-82343","aliases":["CLSA-2026-1789142941","CLSA-2026-1789144988","DEBIAN-CVE-2026-82343","EUVD-2026-67826","GHSA-cj7r-2p4g-x2hx","SUSE-SU-2026:4895-1","UBUNTU-CVE-2026-82343","openSUSE-SU-2026:22123-1"],"status":"published","title":"Gimp: heap out-of-bounds read and stack out-of-bounds access in psd loader from channel-count handling","description":"A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image file, the plugin does not properly validate the channel-count parameter. This incorrect validation leads to improper memory bounds checking, resulting in both a heap out-of-bounds read and a stack out-of-bounds access. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of memory contents.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00183,"percentile":0.07973,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-120"],"published":"2026-08-28T16:26:13Z","modified":"2026-11-06T10:04:48Z","fixes":[{"ecosystem":"Debian:14","package":"gimp","fixed_in":["3.2.6-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9.2.tuxcare.els20"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"gimp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9.2.tuxcare.els20"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"gimp-devel-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9.2.tuxcare.els20"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"gimp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9.2.tuxcare.els20"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9_6.2.tuxcare.els20"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"gimp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9_6.2.tuxcare.els20"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"gimp-devel-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9_6.2.tuxcare.els20"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"gimp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9_6.2.tuxcare.els20"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.10.34-1","2.10.34-1+deb12u1","2.10.34-1+deb12u10","2.10.34-1+deb12u2","2.10.34-1+deb12u3","2.10.34-1+deb12u4","2.10.34-1+deb12u5","2.10.34-1+deb12u6","2.10.34-1+deb12u7","2.10.34-1+deb12u8","2.10.34-1+deb12u9","2.10.36-1","2.10.36-2","2.10.36-3","2.10.38-1","2.10.38-2","2.99.10-1","2.99.12-1","2.99.12-2","2.99.14-1","2.99.14-2","2.99.16-1","2.99.16-2","2.99.18-1","3.0.0-1","3.0.0-2","3.0.0~RC1-1","3.0.0~RC1-3","3.0.0~RC1-4","3.0.0~RC2-1","3.0.0~RC3-1","3.0.2-1","3.0.2-2","3.0.2-3","3.0.2-3.1","3.0.4-1","3.0.4-2","3.0.4-3","3.0.4-4","3.0.4-5","3.0.4-6","3.0.4-6.1","3.0.4-6.2","3.0.6-1","3.2.0-1","3.2.0~RC2-1","3.2.0~RC2-2","3.2.0~RC2-3","3.2.0~RC2-3.1","3.2.0~RC2-3.2","3.2.0~RC2-3.3","3.2.0~RC3-1","3.2.2-1","3.2.4-1","3.2.4-2","3.2.4-3","3.2.6-1","3.2.8-1"]},{"source":"osv","ecosystem":"Debian:13","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.4-3","3.0.4-3+deb13u1","3.0.4-3+deb13u10","3.0.4-3+deb13u11","3.0.4-3+deb13u2","3.0.4-3+deb13u3","3.0.4-3+deb13u4","3.0.4-3+deb13u5","3.0.4-3+deb13u6","3.0.4-3+deb13u7","3.0.4-3+deb13u8","3.0.4-3+deb13u9","3.0.4-4","3.0.4-5","3.0.4-6","3.0.4-6.1","3.0.4-6.2","3.0.6-1","3.2.0-1","3.2.0~RC2-1","3.2.0~RC2-2","3.2.0~RC2-3","3.2.0~RC2-3.1","3.2.0~RC2-3.2","3.2.0~RC2-3.3","3.2.0~RC3-1","3.2.2-1","3.2.4-1","3.2.4-2","3.2.4-3","3.2.6-1","3.2.8-1"]},{"source":"osv","ecosystem":"Debian:14","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.6-1"}]}],"versions":["3.0.4-3","3.0.4-4","3.0.4-5","3.0.4-6","3.0.4-6.1","3.0.4-6.2","3.0.6-1","3.2.0-1","3.2.0~RC2-1","3.2.0~RC2-2","3.2.0~RC2-3","3.2.0~RC2-3.1","3.2.0~RC2-3.2","3.2.0~RC2-3.3","3.2.0~RC3-1","3.2.2-1","3.2.4-1","3.2.4-2","3.2.4-3"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.30-150400.3.85.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.30-150400.3.85.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.14-1ubuntu2","2.8.14-1.2ubuntu1","2.8.16-1ubuntu1","2.8.16-1ubuntu1.1","2.8.16-1ubuntu1.1+esm1","2.8.16-1ubuntu1.1+esm2","2.8.16-1ubuntu1.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.20-1","2.8.20-1.1","2.8.20-2","2.8.22-1","2.8.22-1ubuntu0.1~esm1","2.8.22-1ubuntu0.1~esm2","2.8.22-1ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.10.8-2","2.10.14-2","2.10.14-2build1","2.10.14-2ubuntu1","2.10.14-3","2.10.18-1","2.10.18-1ubuntu0.1","2.10.18-1ubuntu0.1+esm1","2.10.18-1ubuntu0.1+esm2","2.10.18-1ubuntu0.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.10.24-2","2.10.28-1","2.10.30-1","2.10.30-1build1","2.10.30-1ubuntu0.1","2.10.30-1ubuntu0.1+esm1","2.10.30-1ubuntu0.1+esm2","2.10.30-1ubuntu0.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.10.34-1","2.10.36-1","2.10.36-2","2.10.36-3build2","2.10.36-3build3","2.10.36-3ubuntu0.24.04.1","2.10.36-3ubuntu0.24.04.1+esm1","2.10.36-3ubuntu0.24.04.1+esm2","2.10.36-3ubuntu0.24.04.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.2-1","3.2.4-1","3.2.4-2","3.2.4-3","3.2.6-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.4-6.1","3.0.4-6.2","3.0.6-1","3.2.0~RC2-2","3.2.0~RC2-3","3.2.0~RC2-3.1","3.2.0~RC2-3.2","3.2.0~RC2-3.3","3.2.0~RC3-1","3.2.0-1","3.2.2-1","3.2.2-1ubuntu0.26.04.1"]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-bp160.13.1"}]}],"bundled":6}],"products":[{"vendor":"gimp","product":"gimp"},{"vendor":"gnome","product":"gimp"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"redhat","product":"enterprise_linux"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-82343","tags":["vdb-entry","x_refsource_REDHAT","Vendor Advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2525644","tags":["issue-tracking","x_refsource_REDHAT","Issue Tracking","Vendor Advisory","report"]},{"url":"https://gitlab.gnome.org/GNOME/gimp/-/work_items/16587","tags":["Issue Tracking","Mitigation","Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82343","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-cj7r-2p4g-x2hx"},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1789142941.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80101","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1789144988.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-82343","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264895-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1277618","tags":["report"]},{"url":"https://bugzilla.suse.com/1277622","tags":["report"]},{"url":"https://bugzilla.suse.com/1284473","tags":["report"]},{"url":"https://bugzilla.suse.com/1284474","tags":["report"]},{"url":"https://bugzilla.suse.com/1284475","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-106061","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-106062","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-106063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-82328","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-82343","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-82343","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-82343","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1277594","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-82324","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-82343","title":"Gimp: heap out-of-bounds read and stack out-of-bounds access in psd loader from channel-count handling","description":"A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image file, the plugin does not properly validate the channel-count parameter. This incorrect validation leads to improper memory bounds checking, resulting in both a heap out-of-bounds read and a stack out-of-bounds access. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of memory contents.","status":"published","published":"2026-08-28T16:26:13.284Z","modified":"2026-11-06T01:04:41.08Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-120"],"updated_at":"2026-11-06T02:55:55.947181Z"}],"euvd":[{"id":"EUVD-2026-67826","description":"A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image file, the plugin does not properly validate the channel-count parameter. This incorrect validation leads to improper memory bounds checking, resulting in both a heap out-of-bounds read and a stack out-of-bounds access. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of memory contents.","status":"published","published":"2026-08-28T16:26:13Z","modified":"2026-11-06T01:04:41Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium"}],"updated_at":"2026-11-06T02:02:53.341523Z"}],"ghsa":[{"id":"GHSA-cj7r-2p4g-x2hx","title":"A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image...","description":"A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image file, the plugin does not properly validate the channel-count parameter. This incorrect validation leads to improper memory bounds checking, resulting in both a heap out-of-bounds read and a stack out-of-bounds access. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of memory contents.","status":"published","published":"2026-08-28T21:31:28Z","modified":"2026-08-28T21:31:36Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T15:11:08.705354Z"}],"nvd":[{"id":"CVE-2026-82343","description":"A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image file, the plugin does not properly validate the channel-count parameter. This incorrect validation leads to improper memory bounds checking, resulting in both a heap out-of-bounds read and a stack out-of-bounds access. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of memory contents.","status":"published","published":"2026-08-28T20:20:21.527Z","modified":"2026-11-06T01:17:54.957Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-120"],"updated_at":"2026-11-06T06:59:05.303911Z"}],"osv":[{"id":"DEBIAN-CVE-2026-82343","description":"A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image file, the plugin does not properly validate the channel-count parameter. This incorrect validation leads to improper memory bounds checking, resulting in both a heap out-of-bounds read and a stack out-of-bounds access. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of memory contents.","status":"published","published":"2026-08-28T20:20:21.527Z","modified":"2026-11-06T10:04:48.114661506Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium"}],"updated_at":"2026-11-06T10:38:22.758306Z"},{"id":"UBUNTU-CVE-2026-82343","description":"A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image file, the plugin does not properly validate the channel-count parameter. This incorrect validation leads to improper memory bounds checking, resulting in both a heap out-of-bounds read and a stack out-of-bounds access. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of memory contents.","status":"published","published":"2026-08-28T20:20:00Z","modified":"2026-10-17T13:01:11.278283204Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:57:22.213888Z"},{"id":"CLSA-2026-1789142941","title":"gimp: Fix of 2 CVEs","description":"- CVE-2026-80101: size the XWD 1-bit scanline buffers on the number of bytes\n  the decode loops actually read, ceil(width / 8), instead of trusting\n  l_bytes_per_line alone, and zero-fill them; the upstream guard is\n  re-authored because its own arithmetic is inoperative\n- CVE-2026-82343: reject PSD files whose declared channel count is below the\n  minimum required by the color mode, so the merged image is no longer read\n  with more bytes per pixel than were allocated (upstream's channel_idx array\n  enlargement is not applicable: that write path does not exist in 2.99.8)","status":"published","published":"2026-09-11T16:09:13Z","modified":"2026-10-26T09:30:45.101381778Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1789144988","title":"gimp: Fix of 2 CVEs","description":"- CVE-2026-80101: size the XWD 1-bit scanline buffers on the number of bytes\n  the decode loops actually read, ceil(width / 8), instead of trusting\n  l_bytes_per_line alone, and zero-fill them; the upstream guard is\n  re-authored because its own arithmetic is inoperative\n- CVE-2026-82343: reject PSD files whose declared channel count is below the\n  minimum required by the color mode, so the merged image is no longer read\n  with more bytes per pixel than were allocated (upstream's channel_idx array\n  enlargement is not applicable: that write path does not exist in 2.99.8)","status":"published","published":"2026-09-11T16:43:20Z","modified":"2026-10-26T09:31:32.864760981Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"openSUSE-SU-2026:22123-1","title":"Security update for gimp","description":"This update for gimp fixes the following issues:\n\nChanges in gimp:\n\n- CVE-2026-106061: plug-ins: Bound allocation for XMC import (bsc#1284473)\n- CVE-2026-106062: plug-ins/file-dds: fix out of bounds write (bsc#1284474)\n- CVE-2026-106063: plug-ins: Add bounds checks for DICOM export (bsc#1284475)\n- CVE-2026-82324: plug-ins: Add more checks for IFF import (bsc#1277594)\n- CVE-2026-82328: plug-ins: Use BPP for ICO palette allocation (bsc#1277618)\n- CVE-2026-82343: plug-ins: fix heap out of bounds in PSD loader (bsc#1277622)\n","status":"published","published":"2026-10-16T20:56:27Z","modified":"2026-10-19T17:23:15.387370168Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:4895-1","title":"Security update for gimp","description":"This update for gimp fixes the following issues:\n\n- CVE-2026-82328: undersized palette memory allocations in the ICO loader can cause heap out-of-bounds reads\n  (bsc#1277618).\n- CVE-2026-82343: improper channel-count handling in the PSD loader can cause heap and stack out-of-bounds reads\n  (bsc#1277622).\n- CVE-2026-106061: integer overflow in the X cursor thumbnail loader leads to out-of-bounds read and process crash when\n  generating a thumbnail for a crafted XMC file (bsc#1284473).\n- CVE-2026-106062: heap-based buffer overflow in DirectDraw Surface loader when loading a crafted DDS image\n  (bsc#1284474).\n- CVE-2026-106063: heap-based buffer overflow in the DICOM export plug-in when exporting an image with extremely large\n  width and height (bsc#1284475).\n","status":"published","published":"2026-10-23T10:51:03Z","modified":"2026-10-24T17:23:09.3459046Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}