CVE-2026-58384
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
A flaw was found in GIMP's PSD parser. An integer overflow in read_RLE_channel() causes an undersized heap allocation for the RLE row-length table, after which subsequent per-row writes corrupt heap memory. This could lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.
Risk Assessment
The risk for the organization includes potential remote code execution by an attacker delivering a crafted PSD file, which could lead to system compromise or service disruption.
Recommendation
It is recommended to immediately update GIMP to the latest version containing the fix for CVE-2026-58384. Also consider restricting opening PSD files from untrusted sources.
Original NVD description (English source)
A flaw was found in GIMP's PSD parser. An integer overflow in read_RLE_channel() can cause an undersized heap allocation for the RLE row-length table, after which subsequent per-row writes corrupt heap memory. This could lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.