Skip to main content

GIMP CVE-2026-58379

| EUVDEUVD-2026-41560 HIGH
Heap-based Buffer Overflow (CWE-122)
2026-07-03 redhat GHSA-rx3j-28q8-xw3m
7.3
CVSS 3.1 · Vendor: redhat
Share

Severity by source

Vendor (redhat) PRIMARY
7.3 HIGH
AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Opening a crafted file needs no privileges (PR:N over the vendor's PR:L) but requires local file-open interaction (AV:L/UI:R); a heap overflow to code execution yields full C:H/I:H/A:H.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
7.8 HIGH
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Red Hat
7.3 HIGH
qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 03, 2026 - 19:21 vuln.today
CVE Published
Jul 03, 2026 - 18:29 cve.org
HIGH 7.3

DescriptionCVE.org

A flaw was found in GIMP's Paint Shop Pro (PSP) file format parser. This heap buffer overflow vulnerability allows a remote attacker to cause arbitrary code execution or a denial of service (DoS) by tricking a user into opening a specially crafted PSP image file. The vulnerability occurs because the software incorrectly calculates buffer sizes when processing low bit-depth images, leading to an overwrite of adjacent memory.

AnalysisAI

Heap-based buffer overflow in GIMP's Paint Shop Pro (PSP) image format parser lets an attacker achieve arbitrary code execution or crash the application when a victim opens a maliciously crafted PSP file. The flaw stems from incorrect buffer-size arithmetic on low bit-depth images, and affects GIMP as shipped across Red Hat Enterprise Linux 6 through 9. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; exploitation requires local file-open interaction (CVSS 7.3).

Technical ContextAI

GIMP is a widely used open-source raster image editor that includes native import plug-ins for many legacy formats, including the Paint Shop Pro (PSP/PSPImage) format. The vulnerability lives in the PSP loader's handling of low bit-depth (e.g. 1/4/8-bit indexed) image blocks, where the code miscalculates the size of a heap allocation relative to the decoded pixel/channel data, then writes past the end of that buffer. This is classic CWE-122 (heap-based buffer overflow): attacker-controlled dimensions/bit-depth fields in the file header drive an undersized allocation, and subsequent copy operations overwrite adjacent heap metadata or objects, which can be leveraged for control-flow hijack or a straightforward crash. The Red Hat CPEs indicate the affected distribution channel is the GIMP package bundled with RHEL 6/7/8/9 rather than a RHEL OS component itself.

RemediationAI

Apply the vendor GIMP package update once released for your RHEL version; the upstream code fix is available as GNOME GIMP commit https://gitlab.gnome.org/GNOME/gimp/-/commit/b630f167, so this is best described as an upstream fix available (commit); a released patched RHEL package version is not independently confirmed in the provided data, so monitor https://access.redhat.com/security/cve/CVE-2026-58379 for the errata and exact fixed NEVRA. Until the patched package is installed, the most effective compensating control is to avoid opening untrusted or unsolicited PSP/PSPImage files in GIMP and to treat PSP attachments from email or the web as hostile; where feasible, remove or disable the PSP import plug-in from the GIMP plug-ins directory (trade-off: legitimate PSP files can no longer be opened) and open unknown images in a sandboxed or non-privileged session to limit the blast radius of a successful overwrite. Do not rely on file extension filtering alone, since the format is identified by content.

CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash

CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft

CVE-2026-59090 CRITICAL
9.9 Aug 10

Arbitrary code execution in GIMP's PSD import plugin allows an attacker to run code in the context of the user who opens

CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo

CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a

CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe

CVE-2026-33845 CRITICAL
9.1 Apr 30

Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege

CVE-2026-16526 HIGH
8.8 Jul 30

Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe

CVE-2026-11610 HIGH
8.8 Jul 07

Denial of service in Red Hat / 389 Directory Server (389-ds-base, versions since ~1.3.2/2013) allows an authenticated LD

CVE-2026-14474 HIGH
8.8 Jul 07

Local-to-domain-wide root privilege escalation in SSSD's LDAP sudo provider allows an authenticated LDAP directory user

CVE-2026-52720 HIGH
8.8 Jun 15

Heap buffer overflow in GStreamer's librfb (RFB/VNC client) allows a malicious VNC server to corrupt heap memory on a co

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Liberty Linux 9 Fixed
openSUSE Leap 16.0 Fixed
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected
SUSE Linux Enterprise Workstation Extension 15 SP7 Affected

Share

CVE-2026-58379 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy