GIMP file-psd CVE-2026-82343

Exploitation requires that a user open a specially crafted PSD file in GIMP - this is the sole trigger condition. The vulnerability resides in the file-psd plugin's channel-count parsing path, so any GIMP installation with this plugin active is potentially vulnerable when processing PSD input. CVSS PR:N confirms no privilege elevation or authentication is needed on the attacker side; however, CVSS AV:L and UI:R confirm the file must reach the local filesystem and the user must actively open it - passive or background processing does not occur. Limiting factors for defenders: GIMP is a desktop application with no network listener, there is no remote code execution path based on current impact data (C:L/I:N), and the crash is deterministic and immediately visible to the user. Non-RHEL GIMP distributions may also be affected but are not confirmed by the available CPE data.

The CVSS 3.1 base score of 6.1 with vector AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H accurately reflects a moderate-risk, locally-triggered issue. Attack complexity is low once a malicious PSD is crafted, but the local attack vector and mandatory user interaction (UI:R) are meaningful barriers: the attacker must deliver the file and persuade the victim to open it in GIMP. There is no network-reachable attack surface. The primary impact is availability (A:H - application crash), with only limited confidentiality exposure (C:L - partial memory disclosure from adjacent heap regions). Integrity is unaffected. No EPSS score was provided in the source data, but the combination of no KEV listing, no reported POC, local-only attack vector, and user-interaction requirement places this firmly in the 'monitor and patch on normal cycle' tier rather than emergency response. The highest realistic concern is a targeted social-engineering scenario (malicious PSD delivered via email or download) rather than opportunistic mass exploitation.

An attacker crafts a PSD image with a malformed channel-count field set to an out-of-range value and delivers it to a target user via email attachment, file share, or a website offering a download. When the user opens the file in GIMP on a RHEL workstation, the file-psd plugin reads the unchecked channel-count and performs memory accesses beyond allocated heap and stack regions, crashing GIMP immediately. In a more targeted scenario, an attacker with the ability to recover crash dumps or observe error output could attempt to infer partial memory contents from the heap out-of-bounds read, though this is an unlikely secondary objective given the limited and uncertain disclosure. No public proof-of-concept has been identified.