EUVD-2026-77472
GHSA-5w7m-4vvh-65j3
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File-open trigger requires user interaction (UI:R) and local execution (AV:L); attacker needs no privileges; full heap RCE potential justifies C:H/I:H/A:H.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
3DescriptionCVE.org
A flaw was found in GIMP's PSP (Paint Shop Pro) file loader. When processing a compressed selection channel, a heap-based buffer overflow can occur due to a mismatch between the allocated buffer size and the amount of data decompressed. A remote attacker could exploit this vulnerability by crafting a malicious PSP file. Opening this file in GIMP could lead to a crash or arbitrary code execution.
AnalysisAI
Heap-based buffer overflow in GIMP's Paint Shop Pro (PSP) file format loader allows arbitrary code execution when a victim opens a crafted PSP image file. The flaw stems from a size mismatch between the buffer allocated for a compressed selection channel and the actual decompressed output, triggering an out-of-bounds write on the heap. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the victim open a specially crafted PSP (Paint Shop Pro) file in GIMP - the PSP loader plug-in must be present and active (it is enabled by default in standard GIMP installations). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.8 score with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H is internally consistent and accurately reflects a user-assisted file-format RCE: no privileges are required of the attacker, complexity is low once the victim opens the file, and the full C/I/A triad is at risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply Red Hat's security update for GIMP on affected RHEL systems as referenced at https://access.redhat.com/security/cve/CVE-2026-90949; no specific patched GIMP version number is confirmed in the available data, so consult the Red Hat advisory directly for the exact RPM version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and inventory all Red Hat Enterprise Linux 6-9 systems with GIMP installed, then communicate risk to system owners and users. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Buffer overflow in the readstr_upto function in plug-ins/script-fu/tinyscheme/scheme.c in GIMP 2.6.12 and earlier, and p
Multiple stack-based buffer overflows in file-xwd.c in the X Window Dump (XWD) plug-in in GIMP 2.8.2 allow remote attack
In GIMP 2.8.22, there is a heap-based buffer overflow in read_channel_data in plug-ins/common/file-psp.c. Rated high sev
fits-io.c in GIMP before 2.8.1 allows remote attackers to cause a denial of service (NULL pointer dereference and applic
An issue in gimp_layer_invalidate_boundary of GNOME GIMP 2.10.30 allows attackers to trigger an unhandled exception via
GIMP 2.10.30 and 2.99.10 are vulnerable to Buffer Overflow. Rated medium severity (CVSS 5.5), this vulnerability is no a
GIMP through 2.10.2 makes g_get_tmp_dir calls to establish temporary filenames, which may result in a filename that alre
Critical remote code execution vulnerability in GIMP's ICO file parser caused by an integer overflow (CWE-190) that lack
Remote code execution in GIMP 3.0.6 allows attackers to run arbitrary code by tricking a user into opening a malicious P
Remote code execution in GIMP 3.2.0-rc1 lets attackers run arbitrary code by tricking a user into opening a malicious IC
Use-after-free vulnerability in the xcf_load_image function in app/xcf/xcf-load.c in GIMP allows remote attackers to cau
Heap-based buffer overflow in GIMP's TIF file parser enables remote code execution when a user opens a crafted TIFF imag
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today