GIMP PSD File Parsing Vulnerability Discovered in GIMP Software
CVE-2026-18301

7.8HIGH

Key Information:

Vendor

Gimp

Status
Gimp
Vendor
CVE Published:
20 August 2026

What is CVE-2026-18301?

This issue stems from a critical flaw in how GIMP parses PSD files, where the system fails to correctly validate user-supplied data. This oversight can cause an integer overflow while handling data before buffer allocation, paving the way for remote attackers to execute arbitrary code on compromised installations. User action is required as exploitation necessitates visiting a malicious webpage or opening a harmful PSD file, highlighting the importance of maintaining security awareness.

Affected Version(s)

GIMP 3.2.2

References

https://www.zerodayinitiative.com/advisories/ZDI-26-454/
x_research-advisory
https://gitlab.gnome.org/GNOME/gimp/-/merge_requests/2772
vendor-advisory

CVSS V3.0

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.