What is the CVSS score of CVE-2026-2239?

CVE-2026-2239 has a CVSS 3.1 base score of 2.8 (Low). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-2239?

During next maintenance window: Apply vendor patches when convenient. Monitor vendor channels for updates.

Red Hat Enterprise Linux 7 CVE-2026-2239

EUVD-2026-16339 LOW

Improper Null Termination (CWE-170)

2026-03-26 redhat

GHSA-pjv8-58qr-6mxx

Buffer Overflow Denial Of Service Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat

2.8

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-170 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Null terminator handling
Impact	The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L) indicates a local attack vector with low complexity and low privilege requirements, but crucially requires user interaction (UI:R), meaning a user must open a malicious PSD file in GIMP. The impact is limited to availability (denial of service via crash); no confidentiality or integrity compromise is possible. This is a textbook low-risk-despite-ubiquity scenario: while GIMP is widely deployed and the flaw is easily triggered via file interaction, the attack prerequisites (local access, user action, low privileges) substantially limit real-world exploitation probability. No EPSS score, KEV status, or public exploit code is indicated in the provided data, suggesting minimal active exploitation risk at the time of disclosure. The medium priority assigned by Ubuntu and the coordinated advisory issuance across Red Hat, Debian, and SUSE reflect standard vulnerability management practice rather than imminent threat. Remediation should proceed on a normal patch cycle rather than emergency basis.
Exploit ScenarioDerived	An attacker crafts a malicious PSD file with a specially formatted Pascal string in a file header that triggers the null-termination flaw. A local user on a GIMP-equipped system opens the file (either via direct user action or social engineering), causing GIMP to read beyond the allocated buffer when strlen() processes the unterminated string. The application crashes immediately, resulting in loss of any unsaved work and temporary unavailability of the image editor on that session. While this represents a denial of service, the requirement for local access and user action substantially limits practical attack scope to insider threats or multi-stage attacks where file delivery is already achieved.

Monitor Track and reassess. Why: LOW severity (CVSS 0.1-3.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 26, 2026

GIMP's PSD file parser crashes when processing specially crafted Photoshop documents due to improper null-termination in the fread_pascal_string function, allowing local authenticated users to trigger a denial of service. The vulnerability affects GIMP across Red Hat Enterprise Linux 7, 8, and 9, as well as multiple Debian and Ubuntu releases tracked by their respective security teams. While the CVSS score is low (2.8), the widespread distribution across major Linux vendors and confirmed advisory issuance from Red Hat, Debian, and SUSE indicates this merits coordinated patching despite limited exploitability constraints.

RemediationAI

Apply vendor-provided security updates immediately for your distribution: Red Hat users should consult https://access.redhat.com/security/cve/CVE-2026-2239 for RHEL 7, 8, and 9 patch packages; Debian users should apply DLA-4483-1 (for Debian 9 LTS) or DSA-6139-1 (for Debian 10 and later); Ubuntu users should check their distribution's security updates; SUSE users should apply SUSE-SU-2026:0604. Until patching is complete, restrict PSD file opening to trusted sources and educate users not to open PSD files from untrusted origins. No workarounds beyond file restriction are practical given the vulnerability's location in core parsing logic. If GIMP is not essential, temporary removal from systems not requiring it is a valid interim mitigation. Verify patch deployment via package manager confirmation (e.g., apt-cache policy gimp on Debian/Ubuntu or rpm -qi gimp on Red Hat systems) and confirm the version matches the vendor's published fix version once advisory details are fully released.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability exists in GIMP's PSD (Photoshop Document) file format handler, specifically within the fread_pascal_string function responsible for parsing Pascal-format strings embedded in PSD file structures. Pascal strings are length-prefixed byte sequences commonly used in binary file formats; the flaw occurs when the buffer allocated to store such a string is not properly null-terminated before strlen() is invoked on it, creating a classic heap buffer over-read condition (CWE-170: Improper Null Termination). The affected products span Red Hat Enterprise Linux 7, 8, and 9 (cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*, cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*, and cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*), as well as Debian and Ubuntu systems where GIMP is installed. The root cause is a memory safety violation typical of C/C++ image processing codebases handling untrusted binary formats.

Know when Red Hat Enterprise Linux 7 gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 2.8 LOW

AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

Ubuntu MEDIUM

SUSE 3.3 LOW

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Red Hat 2.8 LOW

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

CVE Published

Mar 26, 2026 - 20:00 nvd

LOW 2.8

DescriptionCVE.org

A flaw was found in GIMP. Heap-buffer-overflow vulnerability exists in the fread_pascal_string function when processing a specially crafted PSD (Photoshop Document) file. This occurs because the buffer allocated for a Pascal string is not properly null-terminated, leading to an out-of-bounds read when strlen() is subsequently called. Successfully exploiting this vulnerability can cause the application to crash, resulting in an application level Denial of Service.

Executive ViewAI

Why It Matters

CVE-2026-2239 is a low-severity vulnerability in A flaw (CVSS 2.8). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation. Apply vendor updates when available as part of routine maintenance.

Business Impact: Low

Compensating Controls

Apply vendor patch during routine maintenance. Standard security controls provide adequate interim protection.

Threat Intelligence Overview

EPSS Score

0.0%

Top 98% exploitable

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment Vendor

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity LOW

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

LOW severity (CVSS 0.1-3.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Defer

Exploitation

None

System Exposure· derived

Small

Automatable

Human Impact

Low

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +14

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Affected Products (CPE)CVE.org

cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*

cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*

cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*

More in Red Hat Enterprise Linux 7

View all

CVE-2026-18663 MEDIUM This Month

5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash

CVE-2026-4631 CRITICAL Act Now POC

9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h

CVE-2026-4480 CRITICAL Act Now POC

9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft

CVE-2026-101258 HIGH This Week POC

7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript

CVE-2026-96889 HIGH This Week POC

7.8 Sep 23

Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity

CVE-2026-4775 HIGH This Week POC

7.8 Mar 24

A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to

CVE-2026-114406 MEDIUM This Month POC

6.8 Oct 21

The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe

CVE-2026-59090 CRITICAL Act Now

9.9 Aug 10

Arbitrary code execution in GIMP's PSD import plugin allows an attacker to run code in the context of the user who opens

CVE-2026-18922 CRITICAL Act Now

9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo

CVE-2026-14544 CRITICAL Act Now

9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL Act Now

9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a

CVE-2026-102560 CRITICAL Act Now

9.8 Sep 29

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes

Same weakness CWE-170 – Improper Null Termination

View all

CVE-2021-22931 CRITICAL POC

9.8

CVE-2019-11044 HIGH POC

7.5

CVE-2019-11045 MEDIUM POC

5.9

CVE-2022-47515 HIGH POC

7.5

CVE-2025-66220 HIGH POC

7.1

CVE-2021-1411 CRITICAL

9.9

CVE-2026-5067 CRITICAL

9.8

CVE-2026-8721 CRITICAL

9.8

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

Ubuntu

Priority: Medium

gimp

Release	Status	Version
xenial	needs-triage	-
bionic	needs-triage	-
focal	needs-triage	-
jammy	needs-triage	-
noble	needs-triage	-
questing	needs-triage	-
upstream	needs-triage	-

Debian

Bug #1127838

gimp

Release	Status	Fixed Version	Urgency
bullseye	fixed	2.10.22-4+deb11u6	-
bullseye (security)	fixed	2.10.22-4+deb11u7	-
bookworm	fixed	2.10.34-1+deb12u8	-
bookworm (security)	fixed	2.10.34-1+deb12u9	-
trixie (security), trixie	fixed	3.0.4-3+deb13u7	-
forky	fixed	3.2.0~RC3-1	-
sid	fixed	3.2.0-1	-
trixie	fixed	3.0.4-3+deb13u6	-
(unstable)	fixed	3.2.0~RC2-3.2	-

DLA-4483-1 DSA-6139-1

SUSE

Severity: Low

Product	Status
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 SUSE Linux Enterprise Workstation Extension 15 SP7	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7	Fixed
openSUSE Leap 15.6	Fixed
openSUSE Leap 16.0	Fixed
openSUSE Tumbleweed	Fixed

References

Advisories & patches

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-2239 ADVISORY https://security-tracker.debian.org/tracker/dla-4483-1 ADVISORY https://security-tracker.debian.org/tracker/dsa-6139-1 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0604/ REF https://access.redhat.com/security/cve/CVE-2026-2239 REF https://bugzilla.redhat.com/show_bug.cgi?id=2437675 REF https://gitlab.gnome.org/GNOME/gimp/-/issues/15812

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back

SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7	Fixed
SUSE Linux Enterprise Server 15 SP7	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP7	Fixed
SUSE Linux Enterprise Workstation Extension 15 SP7	Fixed
openSUSE Leap 15.6	Fixed
SUSE Linux Enterprise Server 15 SP4	Fixed
SUSE Linux Enterprise Server 15 SP5	Fixed
SUSE Linux Enterprise Server 15 SP6	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP6	Fixed
SUSE Linux Enterprise Desktop 15 SP4	Fixed
SUSE Linux Enterprise Desktop 15 SP5	Fixed
SUSE Linux Enterprise Desktop 15 SP6	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP4	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP5	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP6	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP4	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP5	Fixed
SUSE Linux Enterprise Workstation Extension 15 SP4	Fixed
SUSE Linux Enterprise Workstation Extension 15 SP5	Fixed
SUSE Linux Enterprise Workstation Extension 15 SP6	Fixed
openSUSE Leap 15.4	Fixed
openSUSE Leap 15.5	Fixed