EUVD-2026-80049
GHSA-v7fc-wcg3-84gx
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local vector because a crafted file must be opened/previewed locally (AV:L, UI:R); no account needed (PR:N); memory corruption enabling code execution justifies C:H/I:H/A:H with no scope change.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
3DescriptionCVE.org
A flaw was found in the file-psd plugin in GIMP. When generating a thumbnail preview for a specially crafted PSD (Photoshop Document) image file, an integer overflow occurs during the multiplication of values from an embedded JPEG header. This leads to an undersized heap allocation, resulting in a heap-based buffer overflow when the image data is decoded. This buffer overflow corrupts adjacent heap objects, allowing for a controlled memory write that can result in an application crash or arbitrary code execution.
AnalysisAI
Heap-based buffer overflow in GIMP's file-psd import plugin allows a crafted PSD file to corrupt adjacent heap memory, causing an application crash or potentially arbitrary code execution when the user opens the file or when a thumbnail preview is generated for it. The root cause is an integer overflow (CWE-190) in the multiplication of values taken from an embedded JPEG header, which yields an undersized heap allocation that is subsequently overrun during image decoding and can be turned into a controlled memory write. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to process an attacker-controlled PSD file with GIMP - either by explicitly opening it via the file-psd import plugin or by triggering thumbnail-preview generation for that file. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8 High) describes a local, user-interaction-dependent memory-corruption flaw in GIMP's file-psd import plugin, not a remotely reachable service bug. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch was identified in the available data, so the immediate priority is to track the fix upstream via the GNOME GitLab work item (https://gitlab.gnome.org/GNOME/gimp/-/work_items/16775) and the Red Hat advisory/bugzilla entries (https://access.redhat.com/security/cve/CVE-2026-92248, https://bugzilla.redhat.com/show_bug.cgi?id=2534282), and to apply the patched GIMP build as soon as the vendor publishes it. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all systems with GIMP installed, especially those that automatically generate PSD thumbnails (e.g., file managers, content management systems); disable thumbnail previews for PSD files and instruct users not to open PSD files from untrusted sources. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Buffer overflow in the readstr_upto function in plug-ins/script-fu/tinyscheme/scheme.c in GIMP 2.6.12 and earlier, and p
Multiple stack-based buffer overflows in file-xwd.c in the X Window Dump (XWD) plug-in in GIMP 2.8.2 allow remote attack
In GIMP 2.8.22, there is a heap-based buffer overflow in read_channel_data in plug-ins/common/file-psp.c. Rated high sev
fits-io.c in GIMP before 2.8.1 allows remote attackers to cause a denial of service (NULL pointer dereference and applic
An issue in gimp_layer_invalidate_boundary of GNOME GIMP 2.10.30 allows attackers to trigger an unhandled exception via
GIMP 2.10.30 and 2.99.10 are vulnerable to Buffer Overflow. Rated medium severity (CVSS 5.5), this vulnerability is no a
GIMP through 2.10.2 makes g_get_tmp_dir calls to establish temporary filenames, which may result in a filename that alre
Critical remote code execution vulnerability in GIMP's ICO file parser caused by an integer overflow (CWE-190) that lack
Remote code execution in GIMP 3.0.6 allows attackers to run arbitrary code by tricking a user into opening a malicious P
Remote code execution in GIMP 3.2.0-rc1 lets attackers run arbitrary code by tricking a user into opening a malicious IC
Use-after-free vulnerability in the xcf_load_image function in app/xcf/xcf-load.c in GIMP allows remote attackers to cau
Heap-based buffer overflow in GIMP's TIF file parser enables remote code execution when a user opens a crafted TIFF imag
Same weakness CWE-190 – Integer Overflow or Wraparound
View allShare
External POC / Exploit Code
Leaving vuln.today