A flaw was found in GIMP's Paint Shop Pro (PSP) file format parser. This heap buffer overflow vulnerability allows a remote attacker to cause arbitrary code execution or a denial of service (DoS) by tricking a user into opening a specially crafted PSP image file. The vulnerability occurs because the software incorrectly calculates buffer sizes when processing low bit-depth images, leading to an overwrite of adjacent memory.
Fix
Patch, vendor advisory and mitigation references on NVD 6
- https://access.redhat.com/errata/RHSA-2026:38496 Patch, Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:73768 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:80509 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-58379 Vendor Advisory
- https://gitlab.gnome.org/GNOME/gimp/-/commit/b630f167 Patch
- https://gitlab.gnome.org/GNOME/gimp/-/issues/16205 Issue Tracking, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 3
- Cpes+4 CPE criteria (now 4)NVD modified 2026-10-20 16:25
- StatusUndergoing Analysis → AnalyzedNVD modified 2026-10-20 16:25
- First seenCVSS 7.3NVD modified 2026-10-12 03:17
Affected (CPE criteria) 4
cpe:2.3:a:gimp:gimp:3.2.1:*:*:*:*:*:*:*cpe:2.3:a:redhat:enterprise_linux_update_services_for_sap_solutions:9.4:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_eus:9.6:*:*:*:*:*:*:*
References 7
- https://access.redhat.com/errata/RHSA-2026:38496 Patch, Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:73768 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:80509 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-58379 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2495997 Issue Tracking
- https://gitlab.gnome.org/GNOME/gimp/-/commit/b630f167 Patch
- https://gitlab.gnome.org/GNOME/gimp/-/issues/16205 Issue Tracking, Vendor Advisory