CVE-2026-119528: Gimp: gimp: stack buffer overflow in psd image resource header loader
A flaw was found in GIMP. The PSD image resource header loader in getimageresourceheader() incorrectly passes the length of a converted resource name string as the destination size argument to gstrlcpy() when copying into a fixed 256-byte stack buffer. Because gimpanytoutf8() can expand the Pascal-string payload (for example under a single-byte locale), the copy can write past the end of the stack buffer. Opening a crafted PSD file can cause a stack-based buffer overflow in the file-psd plug-in, leading to a crash and potentially arbitrary code execution.
Other sources
A flaw was found in GIMP. The PSD plug-in’s image resource header loader uses an incorrect destination size when copying a converted resource name into a fixed stack buffer. Opening a crafted PSD file can cause a stack-based buffer overflow, leading to a crash and potentially arbitrary code execution.
— NVD