REDHAT-BUG-2496585: High severity GIMP vulnerability
A source-level audit of GIMP's file format plugins identified 2 vulnerabilities in default-install plugins (file-psd, file-paa). Both are triggerable by opening a crafted image file — no user interaction beyond "File > Open" is required. Each finding has been independently reproduced with a standalone PoC and confirmed via AddressSanitizer or arithmetic verification in a Docker environment (Fedora 41, gcc, zlib-devel).
https://gitlab.gnome.org/GNOME/gimp/-/workitems/16510
Affected Software
Event History
Frequently Asked Questions
Are default GIMP installations affected?
Users of a standard GIMP installation are exposed because the affected file-psd and file-paa plugins are installed by default. Opening an attacker-crafted PSD or PAA image is sufficient to trigger the affected code paths.
What does exploitation require?
An attacker needs to persuade a user to open a crafted image file in GIMP. No additional interaction beyond selecting File > Open is required.
What can be done if patching is not immediately possible?
Avoid opening untrusted PSD and PAA files in GIMP until an update is available. This reduces exposure to the vulnerable default plugins.
How can I determine whether a system may have been exposed?
Treat systems as potentially affected if they use GIMP with the default file-psd or file-paa plugins and have opened untrusted PSD or PAA files. The provided information does not include indicators of compromise or a reliable method to determine whether exploitation occurred.