CVE-2026-90949
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
A flaw was found in GIMP's PSP (Paint Shop Pro) file loader. When processing a compressed selection channel, a heap-based buffer overflow can occur due to a mismatch between the allocated buffer size and the amount of data decompressed. A remote attacker could exploit this vulnerability by crafting a malicious PSP file. Opening this file in GIMP could lead to a crash or arbitrary code execution.
Risk Assessment
Opening a malicious PSP file by a user could lead to arbitrary code execution in the context of the GIMP process, and consequently to workstation compromise. This may result in data leakage and further network escalation.
Recommendation
Upgrade GIMP to a patched version. Until then, avoid opening untrusted PSP files.
Other vulnerabilities in GIMP
See all- CVE-2017-17789High
In GIMP 2.8.22, there is a heap-based buffer overflow in read_channel_data in plug-ins/common/file-psp.c.
- CVE-2017-17787High
In GIMP 2.8.22, there is a heap-based buffer over-read in the read_creator_block handler in plug-ins/common/file-psp.c.
- CVE-2017-17786High
In GIMP 2.8.22, there is a heap-based buffer over-read in ReadImage in plug-ins/common/file-tga.c, related to an unexpected bits-per-pixel value for an RGBA image.
- CVE-2017-17785High
In GIMP 2.8.22, there is a heap-based buffer overflow in the fli_read_brun function in plug-ins/file-fli/fli.c.
- CVE-2017-17784High
In GIMP 2.8.22, there is a heap-based buffer over-read in load_image in plug-ins/common/file-gbr.c, related to mishandling of UTF-8 data.
- CVE-2016-4994High
A use-after-free vulnerability in the xcf_load_image function in xcf-load.c in GIMP allows remote attackers to cause a denial of service (program crash) or possibly execute arbitrary code via a crafted XCF file.
- CVE-2026-97185High
In GIMP, when processing a specially crafted GIMPressionist preset file, the plug-in does not properly validate vector indices before writing into fixed-size arrays. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to load a malicious preset file, potentially causing a crash or enabling arbitrary code execution.
- CVE-2026-96546Low
GIMP's uncompressed DDS image loader has a one-byte out-of-bounds heap read flaw. After processing the final pixel, the file-dds plug-in performs an unconditional one-byte look-ahead, which may cause a crash if the byte is inaccessible.
- CVE-2026-96545Medium
An out-of-bounds heap read flaw exists in GIMP's TIM image loader. When a user opens a crafted 4bpp TIM image that causes promotion to an RGBA layer, the file-tim plug-in allocates an undersized row buffer but processes it using the larger RGBA row size. This can copy adjacent heap contents into the decoded image and may crash the plug-in.
- CVE-2026-92248High
A heap-based buffer overflow vulnerability exists in the file-psd plugin in GIMP. When generating a thumbnail preview for a specially crafted PSD file, an integer overflow occurs during multiplication of values from an embedded JPEG header, leading to an undersized heap allocation and a heap-based buffer overflow during image decoding.
Original NVD description (English source)
A flaw was found in GIMP's PSP (Paint Shop Pro) file loader. When processing a compressed selection channel, a heap-based buffer overflow can occur due to a mismatch between the allocated buffer size and the amount of data decompressed. A remote attacker could exploit this vulnerability by crafting a malicious PSP file. Opening this file in GIMP could lead to a crash or arbitrary code execution.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS