CVE-2026-82343: Gimp: heap out-of-bounds read and stack out-of-bounds access in psd loader from channel-count handling
A flaw was found in the file-psd plugin in GIMP, affecting all versions. When processing a specially crafted PSD image file, the plugin does not properly validate the channel-count parameter. This incorrect validation leads to improper memory bounds checking, resulting in both a heap out-of-bounds read and a stack out-of-bounds access. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of memory contents.
Other sources
A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image file, the plugin does not properly validate the channel-count parameter. This incorrect validation leads to improper memory bounds checking, resulting in both a heap out-of-bounds read and a stack out-of-bounds access. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of memory contents.
— MITRE
Affected Software
Event History
Frequently Asked Questions
Which installations are affected?
The issue affects all versions of GIMP in the file-psd plugin. Systems that use this plugin to process PSD image files are within scope.
What is required to trigger the issue?
An attacker needs to cause GIMP to process a specially crafted PSD image whose channel-count parameter is malformed. The vector is local and requires user interaction, such as opening or otherwise processing the file.
What is the likely impact of successful exploitation?
Processing the malicious PSD can crash the application, causing denial of service. It may also result in limited disclosure of memory contents; integrity impact is not indicated.