CVE-2026-82343
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
The file-psd plugin in GIMP contains a flaw where the channel-count parameter is not properly validated when processing specially crafted PSD files. This leads to improper memory bounds checking, resulting in a heap out-of-bounds read and a stack out-of-bounds access. This can cause an application crash, leading to denial of service or limited information disclosure of memory contents.
Risk Assessment
An attacker could cause GIMP to crash, leading to denial of service, and may also access memory fragments, potentially exposing sensitive data.
Recommendation
Update GIMP to a version that includes fixes for the file-psd plugin. Avoid opening untrusted PSD files until the update is applied.
Other vulnerabilities in GIMP
See all- CVE-2026-108093Medium
A flaw was found in GIMP. The XCF loader processes image-simulation-intent and image-simulation-bpc parasites without ensuring the parasite data is present before dereferencing it. Opening a specially crafted XCF file with a zero-size simulation parasite can cause a NULL pointer dereference and crash the GIMP application.
- CVE-2017-17789High
In GIMP 2.8.22, there is a heap-based buffer overflow in read_channel_data in plug-ins/common/file-psp.c.
- CVE-2017-17787High
In GIMP 2.8.22, there is a heap-based buffer over-read in the read_creator_block handler in plug-ins/common/file-psp.c.
- CVE-2017-17786High
In GIMP 2.8.22, there is a heap-based buffer over-read in ReadImage in plug-ins/common/file-tga.c, related to an unexpected bits-per-pixel value for an RGBA image.
- CVE-2017-17785High
In GIMP 2.8.22, there is a heap-based buffer overflow in the fli_read_brun function in plug-ins/file-fli/fli.c.
- CVE-2017-17784High
In GIMP 2.8.22, there is a heap-based buffer over-read in load_image in plug-ins/common/file-gbr.c, related to mishandling of UTF-8 data.
- CVE-2016-4994High
A use-after-free vulnerability in the xcf_load_image function in xcf-load.c in GIMP allows remote attackers to cause a denial of service (program crash) or possibly execute arbitrary code via a crafted XCF file.
- CVE-2026-106067Medium
A heap-based buffer overflow was found in GIMP’s Hot color filter plug-in. For very large images, a pixel buffer is allocated using overflowing 32-bit width * height (and related) arithmetic while the filter’s pixel access path uses the true image size, after integer overflow in the allocation size.
- CVE-2026-106066Medium
GIMP's raw data export plug-in contains a heap-based buffer overflow. When exporting very large images, sizing based on overflowing width * height * bytes-per-pixel can allocate far less memory than GEGL reads or writes during export, leading to a buffer overflow.
- CVE-2026-106065Medium
A heap-based buffer overflow was found in GIMP's PCX export plug-in. For images with extremely large width and height, buffer allocation uses overflowing 32-bit width * height arithmetic while subsequent GEGL operations use the full extent, after integer overflow in size calculation.
Original NVD description (English source)
A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image file, the plugin does not properly validate the channel-count parameter. This incorrect validation leads to improper memory bounds checking, resulting in both a heap out-of-bounds read and a stack out-of-bounds access. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of memory contents.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS