{"id":"CVE-2026-112257","kind":"vulnerability","aliases":["CVE-2026-112257"],"related":[],"title":"GIMP: crafted PSD thumbnail causes heap overflow and possible code execution","description":"A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially arbitrary code execution when the victim browses or opens the file.","summary":"GIMP's PSD thumbnail loader swaps color channels assuming RGB data without checking the embedded JPEG, so a grayscale thumbnail causes out-of-bounds heap reads and writes. An attacker who gets a victim to browse or open a crafted PSD file can crash the plug-in process and possibly run code.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop","gimp","linux","macos","package","windows"],"not_affected_if":["no-psd-files-opened"],"how_to_check":"- Run `gimp --version` and compare against the fixed release in the advisory (unknown in the sources)\n- Check whether your GIMP build or distro package includes the PSD plug-in fix (unknown in the sources)","fix":"- Update GIMP to a release that includes the PSD thumbnail fix (fixed version unknown in the sources)\n- Until patched, avoid opening untrusted PSD files in GIMP","status":"open","published_at":"2026-10-19T22:17:05+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-25T03:10:14+00:00","updated_at":"2026-10-25T03:10:14+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:10:14Z","model":"claude-haiku-5-5","output":{"fix":"- Update GIMP to a release that includes the PSD thumbnail fix (fixed version unknown in the sources)\n- Until patched, avoid opening untrusted PSD files in GIMP","reach":"local","title":"GIMP: crafted PSD thumbnail causes heap overflow and possible code execution","impact":"high","summary":"GIMP's PSD thumbnail loader swaps color channels assuming RGB data without checking the embedded JPEG, so a grayscale thumbnail causes out-of-bounds heap reads and writes. An attacker who gets a victim to browse or open a crafted PSD file can crash the plug-in process and possibly run code.","category":"package","nicknames":[],"who_cares":["gimp","desktop","linux","windows","macos"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker may run code as the GIMP user","analyst_note":"Confirm the affected and fixed GIMP versions and whether a patch is published; the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-112257 is the only source listed.","how_to_check":"- Run `gimp --version` and compare against the fixed release in the advisory (unknown in the sources)\n- Check whether your GIMP build or distro package includes the PSD plug-in fix (unknown in the sources)","needs_analyst":true,"not_affected_if":["no-psd-files-opened"],"who_is_affected":"Anyone who opens or browses untrusted PSD files in GIMP on a desktop or workstation is exposed, since the flaw is in the PSD thumbnail loader. Systems that never process PSD files from outside sources can skip it, though the sources do not confirm the exact affected version range.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000647,"input_tokens":3334,"output_tokens":627,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112257':14A,17A '-2026':13A,16A '3':100C 'arbitrari':141C 'assum':32B 'attack':54B 'bgr':92C 'bgr-to-rgb':91C 'bound':48B,125C 'brows':60B,147C 'byte':101C 'caus':5A,44B,119C 'channel':31B,95C 'check':36B 'code':10A,77B,142C 'color':30B 'craft':2A,64B,114C 'crash':68B,138C 'cve':12A,15A 'data':34B 'desktop':18B 'embed':38B 'execut':11A,143C 'file':66B,151C 'fix':99C 'flaw':79C 'found':81C 'get':56B 'gimp':1A,19B,24B,83C 'grayscal':42B,115C 'heap':6A,49B,121C 'jpeg':39B,109C 'lead':135C 'linux':20B 'loader':28B,88C 'maco':21B 'open':62B,149C 'out-of-bound':45B,122C 'overflow':7A 'packag':22B 'perform':89C 'plug':71B,132C 'plug-in':70B,131C 'possibl':9A,75B 'potenti':140C 'process':73B,134C 'psd':3A,26B,65B,85C,116C 'read':50B,126C 'resourc':87C 'rgb':33B,94C,112C 'run':76B 'stride':102C 'swap':29B,96C 'thumbnail':4A,27B,43B,86C,110C,117C 'verifi':106C 'victim':58B,146C 'window':23B 'without':35B 'write':52B,128C","nicknames":[],"mitigations":[],"who_affected":"Anyone who opens or browses untrusted PSD files in GIMP on a desktop or workstation is exposed, since the flaw is in the PSD thumbnail loader. Systems that never process PSD files from outside sources can skip it, though the sources do not confirm the exact affected version range.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T22:17:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112257","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112257","severity":null,"published_at":"2026-10-19T22:17:05+00:00","modified_at":"2026-10-20T15:17:13+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}