CVE-2026-58381: Gimp: gimp: double-free in read_layer_block()
A double-free vulnerability exists in GIMP's Paint Shop Pro (PSP) file format parser. In readlayerblock() in file-psp.c, the variable name is allocated, used, and freed each loop iteration. On the error path in the 2nd iteration, fread fails before gmalloc for name, so the stale pointer from iteration 1 is freed again via gfree(name).
- Function: readlayerblock() - File: plug-ins/common/file-psp.c:1908-2321 - Fix: https://gitlab.gnome.org/GNOME/gimp/-/commit/b22e147b - Upstream issue: https://gitlab.gnome.org/GNOME/gimp/-/issues/16207 - Acknowledgment: bb1abu
Other sources
A flaw was found in GIMP's PSP file format parser. A double-free condition occurs in the readlayerblock() function when processing a specially crafted PSP file. This could allow an attacker to cause memory corruption, potentially leading to denial of service or arbitrary code execution.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/gimpto a version that resolves this vulnerability.Fixed in 3.0.4-3+deb13u10Fixed in 3.0.4-3+deb13u11Fixed in 3.2.6-1Fixed in 3.2.8-1 - Upgrade
Upgrade
debian/gimpto a version that resolves this vulnerability.Fixed in 3.0.4-3+deb13u10 - Upgrade
Upgrade
debian/gimpto a version that resolves this vulnerability.Fixed in 3.2.4-1 - Upgrade
Upgrade
GIMPto a version that resolves this vulnerability.Patch b22e147b
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs to provide a specially crafted Paint Shop Pro (PSP) file and have it processed by GIMP. The recorded vector indicates local access, low privileges, and user interaction are required.
What can be done while a fix is not yet available?
Avoid opening or processing untrusted PSP files in GIMP. The upstream fix is identified as commit b22e147b.