Live › vulnerability › CVE-2026-112257
Go to dashboardGIMP's PSD thumbnail loader swaps color channels assuming RGB data without checking the embedded JPEG, so a grayscale thumbnail causes out-of-bounds heap reads and writes. An attacker who gets a victim to browse or open a crafted PSD file can crash the plug-in process and possibly run code.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Anyone who opens or browses untrusted PSD files in GIMP on a desktop or workstation is exposed, since the flaw is in the PSD thumbnail loader. Systems that never process PSD files from outside sources can skip it, though the sources do not confirm the exact affected version range.
No product ranges from the sources yet.
gimp --version and compare against the fixed release in the advisory (unknown in the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially arbitrary code execution when the victim browses or opens the file.
This page as .md · .json · in your agent: get_signal("CVE-2026-112257")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.