{"id":"CVE-2026-119528","kind":"vulnerability","aliases":["CVE-2026-119528"],"related":[],"title":"GIMP: crafted PSD file overflows a stack buffer and can run code","description":"A flaw was found in GIMP. The PSD plug-in’s image resource header loader uses an incorrect destination size when copying a converted resource name into a fixed stack buffer. Opening a crafted PSD file can cause a stack-based buffer overflow, leading to a crash and potentially arbitrary code execution.","summary":"GIMP's PSD plug-in copies a converted image resource name into a fixed stack buffer using the wrong size. Opening a crafted PSD file can crash GIMP or potentially run arbitrary code.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop","gimp","linux","other","psd"],"not_affected_if":["no-psd-import","trusted-files-only"],"how_to_check":"Run gimp --version (or Help > About). No affected range is published yet; treat any GIMP that can import PSD as exposed until upstream issue #16799 or your distro lists a fixed build.","fix":null,"status":"open","published_at":"2026-10-30T14:16:45+00:00","first_seen_at":"2026-10-30T14:30:53+00:00","triaged_at":"2026-10-30T14:32:36+00:00","updated_at":"2026-10-30T14:33:51+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-30T14:32:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"GIMP: crafted PSD file overflows a stack buffer and can run code","impact":"high","summary":"GIMP's PSD plug-in copies a converted image resource name into a fixed stack buffer using the wrong size. Opening a crafted PSD file can crash GIMP or potentially run arbitrary code.","audience":"everyone","category":"other","nicknames":[],"who_cares":["gimp","psd","desktop"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code on the machine after a user opens a file.","analyst_note":"Check the NVD entry and upstream GIMP advisory for affected and fixed versions; the sources here state neither.","how_to_check":"- Check the installed GIMP version with `gimp --version` or Help > About in the application.\n- unknown whether the sources list affected version ranges.","plain_action":"Do not open PSD files from unknown sources in GIMP until a fixed version is installed; the sources do not name a fixed version.","needs_analyst":true,"not_affected_if":["no-psd-import"],"who_is_affected":"Anyone who opens PSD files in GIMP is exposed, since the flaw is in the PSD import plug-in that parses the file. The sources do not list affected versions. Teams that never open PSD files in GIMP, or that run GIMP only on trusted files, face lower risk.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000674,"input_tokens":4101,"output_tokens":527,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and upstream GIMP advisory for affected and fixed versions; the sources here state neither.","search":"'-119528':15A,18A '-2026':14A,17A 'arbitrari':56B,109C 'base':100C 'buffer':8A,40B,89C,101C 'caus':96C 'code':12A,57B,110C 'convert':32B,82C 'copi':30B,80C 'craft':2A,47B,92C 'crash':51B,106C 'cve':13A,16A 'desktop':19B 'destin':77C 'execut':111C 'file':4A,49B,94C 'fix':38B,87C 'flaw':59C 'found':61C 'gimp':1A,20B,24B,52B,63C 'header':72C 'imag':33B,70C 'incorrect':76C 'lead':103C 'linux':21B 'loader':73C 'name':35B,84C 'open':45B,90C 'overflow':5A,102C 'plug':28B,67C 'plug-in':27B,66C 'potenti':54B,108C 'psd':3A,23B,26B,48B,65C,93C 'resourc':34B,71C,83C 'run':11A,55B 'size':44B,78C 'stack':7A,39B,88C,99C 'stack-bas':98C 'use':41B,74C 'wrong':43B","nicknames":[],"mitigations":[],"who_affected":"Anyone who opens PSD files in GIMP is exposed, since the flaw is in the PSD import plug-in that parses the file. The sources do not list affected versions. Teams that never open PSD files in GIMP, or that run GIMP only on trusted files, face lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"everyone","plain_action":"Do not open PSD files from unknown sources in GIMP until a fixed version is installed; the sources do not name a fixed version.","first_public_at":"2026-10-30T14:16:45+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119528","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119528","severity":null,"published_at":"2026-10-30T14:16:45+00:00","modified_at":"2026-10-30T14:16:45+00:00","first_seen_at":"2026-10-30T14:30:53+00:00","fetched_at":"2026-10-30T14:30:53+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119528:1162","url":null,"severity":null,"published_at":"2026-10-30T14:33:51+00:00","modified_at":"2026-10-30T14:33:51+00:00","first_seen_at":"2026-10-30T14:33:51+00:00","fetched_at":"2026-10-30T14:33:51+00:00","note":"Red Hat advisory read (Important, CWE-121, upstream issue gitlab.gnome.org GIMP #16799, unreadable via web-cli). No affected/fixed versions found on any page; fix unknown, left unverified. Mitigation per Red Hat: do not open untrusted PSD, avoid browsing PSD dirs in file dialog (thumbnails), remove gimp if unneeded."}],"documents":[{"id":23983,"url":"https://access.redhat.com/security/cve/CVE-2026-119528","title":"Red Hat CVE-2026-119528","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}