CVE-2026-112257 PUBLISHED

Gimp: gimp: heap out-of-bounds read/write in psd thumbnail loader (load_resource_1033)

Assigner: redhat
Reserved: 19.10.2026 Published: 19.10.2026 Updated: 20.10.2026

A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially arbitrary code execution when the victim browses or opens the file.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS Score: 7.8

Attack Vector	Local	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	None	Integrity Impact	High
User Interaction	Required	Availability Impact	High

CVSS 3.1

Product Status

Vendor	Red Hat
Product	Red Hat Enterprise Linux 10
Versions	Default: affected

Vendor	Red Hat
Product	Red Hat Enterprise Linux 6
Versions	Default: unknown

Vendor	Red Hat
Product	Red Hat Enterprise Linux 7
Versions	Default: affected

Vendor	Red Hat
Product	Red Hat Enterprise Linux 8
Versions	Default: affected

Vendor	Red Hat
Product	Red Hat Enterprise Linux 9
Versions	Default: affected

Workarounds

Avoid opening or browsing untrusted PSD files in GIMP. If GIMP is unused, remove the gimp package.

Credits

Red Hat would like to thank Alexey Khairov (codem4ster), Konstantin Talgarenko (Marcusov), and Nikolay Kravtsov (Kolya080808) for reporting this issue.

References

Problem Types

Stack-based Buffer Overflow CWE