CVE-2026-90949: Gimp: gimp: heap-based buffer overflow in psp loader due to selection-channel geometry mismatch
A flaw was found in GIMP's PSP (Paint Shop Pro) file loader. When processing a compressed selection channel, a heap-based buffer overflow can occur due to a mismatch between the allocated buffer size and the amount of data decompressed. A remote attacker could exploit this vulnerability by crafting a malicious PSP file. Opening this file in GIMP could lead to a crash or arbitrary code execution.
Other sources
A heap-based buffer overflow flaw was found in GIMP's PSP (Paint Shop Pro) file loader. When processing a compressed selection channel, readselectionblock() allocates a buffer sized to the selection rectangle's dimensions, while readchanneldata() derives the amount of data to decompress from the full image dimensions instead. A specially crafted PSP file can exploit this mismatch to decompress data far exceeding the allocated buffer, causing a heap-based buffer overflow. An attacker could exploit this by crafting a malicious PSP file that, when opened in GIMP, leads to a crash or arbitrary code execution in the context of the user running GIMP.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
An attacker must craft a malicious Paint Shop Pro (PSP) file containing a compressed selection channel whose selection geometry differs from the full image geometry. The victim must open that file in GIMP.
Is exploitation possible without an existing GIMP account or privileges?
Yes. The vulnerability has no privilege requirement, but it requires user interaction because the malicious PSP file must be opened in GIMP. Code execution or a crash would occur in the context of the user running GIMP.
What impact should be expected if a malicious file is opened?
The malformed file can cause a heap-based buffer overflow, potentially resulting in a GIMP crash or arbitrary code execution with the affected user's privileges.