Buffer Overflow Vulnerability in GIMP's PSD Plugin
CVE-2026-92248

7.8HIGH

Key Information:

Vendor

Red Hat
Status
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Vendor
CVE Published:
15 September 2026

What is CVE-2026-92248?

A flaw in the file-psd plugin of GIMP can lead to a buffer overflow vulnerability when processing specially crafted PSD image files. Specifically, an integer overflow occurs during the multiplication of values extracted from the embedded JPEG header, resulting in insufficient heap allocation. This can trigger a heap-based buffer overflow during image data decoding, potentially allowing attackers to corrupt adjacent memory, leading to application crashes or enabling the execution of arbitrary code.

References

https://access.redhat.com/security/cve/CVE-2026-92248
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2534282
issue-trackingx_refsource_REDHAT
https://gitlab.gnome.org/GNOME/gimp/-/work_items/16775

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Tan Inn Fung for reporting this issue.
.