CVE-2026-92248: Gimp: integer overflow when generating a thumbnail preview for a psd file
A flaw was found in the file-psd plugin in GIMP. When generating a thumbnail preview for a specially crafted PSD (Photoshop Document) image file, an integer overflow occurs during the multiplication of values from an embedded JPEG header. This leads to an undersized heap allocation, resulting in a heap-based buffer overflow when the image data is decoded. This buffer overflow corrupts adjacent heap objects, allowing for a controlled memory write that can result in an application crash or arbitrary code execution.
Affected Software
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
An attacker must induce a user to generate a thumbnail preview for a specially crafted PSD file. The vulnerable path processes values from an embedded JPEG header in that PSD.
What impact could successful exploitation have?
The heap-based buffer overflow can corrupt adjacent heap objects, causing an application crash or potentially allowing arbitrary code execution. The affected user does not need prior privileges according to the provided vector.
How can I tell whether my environment is exposed?
Exposure depends on whether GIMP's file-psd plugin is present and processes thumbnail previews for PSD files. The provided information does not identify affected or fixed GIMP versions.
What can be done if patching is not immediately possible?
Avoid generating thumbnail previews for untrusted PSD files, particularly files that may contain attacker-controlled embedded JPEG data. Treat PSD files from untrusted sources as potentially malicious until an update is available.