Live › vulnerability › CVE-2026-119528
GIMP's PSD plug-in copies a converted image resource name into a fixed stack buffer using the wrong size. Opening a crafted PSD file can crash GIMP or potentially run arbitrary code.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 14:30 UTC. All times on this page are UTC.
Anyone who opens PSD files in GIMP is exposed, since the flaw is in the PSD import plug-in that parses the file. The sources do not list affected versions. Teams that never open PSD files in GIMP, or that run GIMP only on trusted files, face lower risk.
No product ranges from the sources yet.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in GIMP. The PSD plug-in’s image resource header loader uses an incorrect destination size when copying a converted resource name into a fixed stack buffer. Opening a crafted PSD file can cause a stack-based buffer overflow, leading to a crash and potentially arbitrary code execution.
This page as .md · .json · in your agent: get_signal("CVE-2026-119528")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.