CVE-2026-112257: Integer Overflow
A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially arbitrary code execution when the victim browses or opens the file.
Other sources
A flaw was found in the GIMP PSD plug-in thumbnail loader. When a PSD embeds a grayscale JPEG thumbnail, the BGR-to-RGB swap in loadresource1033() uses a hard-coded 3-byte stride without checking the JPEG component count, reading and writing past the heap buffer. The overflow length is controlled by the file. This can be triggered during thumbnail generation in the file chooser, without fully opening the image. This is distinct from CVE-2026-92248 (thumbnail allocation integer overflow).
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Can the issue be triggered without fully opening an image?
Yes. Processing can occur during thumbnail generation in the file chooser when a user browses a crafted PSD file.
What does exploitation require?
An attacker needs to provide a crafted PSD containing a grayscale JPEG thumbnail and induce the victim to browse or open it. The CVSS vector indicates no privileges are required, but user interaction is required.