EUVD-2026-42020
GHSA-pp89-6qxc-wh8f
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Opening a malicious file needs no prior privileges (PR:N) but requires the user to open it (UI:R) via a local file (AV:L); memory corruption enables full C/I/A impact in the user context.
Primary rating from Vendor (redhat).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
A flaw was found in GIMP's PSD parser. An integer overflow in read_RLE_channel() can cause an undersized heap allocation for the RLE row-length table, after which subsequent per-row writes corrupt heap memory. This could lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.
AnalysisAI
Heap memory corruption in GIMP's PSD (Photoshop) file parser allows a malicious .psd image to overflow an integer in read_RLE_channel(), producing an undersized heap allocation for the RLE row-length table that is then overwritten row-by-row, potentially yielding denial of service or arbitrary code execution. The flaw affects GIMP as shipped across Red Hat Enterprise Linux 6 through 9 and is triggered when a victim opens or imports a crafted PSD file. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
GIMP is the GNU Image Manipulation Program, a widely used open-source raster graphics editor bundled by default in many Linux distributions. The bug lives in its native PSD import codec, which decodes Adobe Photoshop's RLE (PackBits) compressed channel data. Per CWE-190 (Integer Overflow or Wraparound), an arithmetic computation of the RLE row-length table size wraps around, so the subsequent heap allocation is far smaller than the number of rows the decoder will actually write. Because the per-row length values are then written past the end of the too-small buffer, adjacent heap metadata and objects are corrupted - a classic parser-driven heap overflow reachable purely through file content, with no network service involved.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - the upstream correction is in GNOME GitLab commit da29e217 (https://gitlab.gnome.org/GNOME/gimp/-/commit/da29e217). Apply the GIMP package update from your distribution once released and track the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-58384 for the RHEL 6/7/8/9 errata and fixed build numbers. Until a patched package is installed, the concrete compensating control is to not open or import untrusted or unsolicited .psd files in GIMP, and to treat PSD attachments from email/downloads as suspect; where feasible, convert or triage such files in a sandboxed or throwaway environment first. If PSD handling is not needed, avoid associating .psd files with GIMP so they are not opened automatically. These controls reduce exposure at the cost of workflow friction for legitimate Photoshop file interchange.
More in Red Hat Enterprise Linux 6
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Arbitrary code execution in GIMP's PSD import plugin allows an attacker to run code in the context of the user who opens
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Denial of service in Red Hat / 389 Directory Server (389-ds-base, versions since ~1.3.2/2013) allows an authenticated LD
Local-to-domain-wide root privilege escalation in SSSD's LDAP sudo provider allows an authenticated LDAP directory user
Heap buffer overflow in GStreamer's librfb (RFB/VNC client) allows a malicious VNC server to corrupt heap memory on a co
Same weakness CWE-190 – Integer Overflow or Wraparound
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Liberty Linux 9 | Fixed |
| SUSE Linux Enterprise Desktop 15 SP7 | Not-Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | Not-Affected |
| SUSE Linux Enterprise Server 15 SP7 | Not-Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP7 | Not-Affected |
| SUSE Linux Enterprise Workstation Extension 15 SP7 | Not-Affected |
| SUSE Linux Enterprise Server 15 SP4 | Not-Affected |
| SUSE Linux Enterprise Server 15 SP5 | Not-Affected |
| SUSE Linux Enterprise Server 15 SP6 | Not-Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | Not-Affected |
| SUSE Linux Enterprise Desktop 15 SP4 | Not-Affected |
| SUSE Linux Enterprise Desktop 15 SP5 | Not-Affected |
| SUSE Linux Enterprise Desktop 15 SP6 | Not-Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP4 | Not-Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Not-Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Not-Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | Not-Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | Not-Affected |
| SUSE Linux Enterprise Workstation Extension 15 SP4 | Not-Affected |
| SUSE Linux Enterprise Workstation Extension 15 SP5 | Not-Affected |
| SUSE Linux Enterprise Workstation Extension 15 SP6 | Not-Affected |
| openSUSE Leap 15.4 | Not-Affected |
| openSUSE Leap 15.5 | Not-Affected |
| openSUSE Leap 15.6 | Not-Affected |
Share
External POC / Exploit Code
Leaving vuln.today